CVE-2025-6675

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.8.0 Enterprise MFA - TFA for Drupal versions 5.2.0 through 5.2.0 Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.0.* Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.1.*

Description: The issue affects the Enterprise MFA - TFA for Drupal module, allowing authentication bypass using an alternate path or channel. This is due to the module not sufficiently ensuring that known authorization routes are protected.

Recommendations: For versions 0.0.0 through 4.8.0, update to version 4.8.0 or later. For version 5.2.0, update to version 5.2.1 or later. For versions 0.0.0 through 5.0., update to version 5.0. or later. For versions 0.0.0 through 5.1., update to version 5.1. or later. As a temporary workaround, consider restricting access to known authorization routes to minimize the risk of exploitation.