CVE-2025-6675: Miniorange 2fa

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0.*, from 0.0.0 before 5.1.*.

Affected products

• Miniorange Miniorange 2fa: before 4.8.0 (fixed in 4.8.0); from 5.0.1, before 5.2.1 (fixed in 5.2.1)

Published 2025-06-26. Last modified 2026-06-17.