CVE-2025-47708
EPSS 0.17%
Description
The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't sufficiently protect certain routes from Cross Site Request Forgery (CSRF) attacks.
How to fix CVE-2025-47708
To remediate CVE-2025-47708, upgrade the affected package to a fixed version below.
- Packagist/drupal/miniorange_2fa—upgrade to 4.7.0 or later
Is CVE-2025-47708 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 4.7.0 | >= 5.0.1, < 5.2.0