two-factor authentication vulnerabilities and fixes

Recent CVEs affecting two-factor authentication, with upgrade or downgrade steps. 7 tracked.

Also searched as: two factor authentication, two-factorauthentication.

two-factor authentication has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-07-08. Highest priority: CVE-2024-13239 (score 51/100).

• CVE-2025-7030 MEDIUM 6.5 UPGRADE Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploitin
• CVE-2025-31694 HIGH 8.1 UPGRADE Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This
• CVE-2024-5658 MEDIUM 4.8 UPGRADE The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within
• CVE-2024-5657 LOW 3.7 UPGRADE The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash o
• CVE-2024-13279 CRITICAL 9.8 UPGRADE Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue af
• CVE-2024-13239 CRITICAL 9.8 UPGRADE Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This i
• CVE-2022-4536 MEDIUM 5.3 UPGRADE The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and in

FAQ

How do I fix two-factor authentication vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is two-factor authentication being exploited right now?

None of the tracked two-factor authentication CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which two-factor authentication CVE should I patch first?

CVE-2024-13239 currently ranks highest (51/100): Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This i.

RSS feed for two-factor authentication · ← Back to latest CVEs