Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.
The TFA module's services_tfa submodule (which provided the /auth/tfa web service endpoint) has been deprecated in TFA 8.x-1.4 and removed in TFA 2.0.0. This was the only built-in API endpoint of the web service.
What this means for you:
If you are using standard form-based TFA login only, the existing flood control in EntryForm already protects you. This update provides additional defense-in-depth.
Migration note:
If you migrated the email plugin from the patch (https://www.drupal.org/project/tfa/issues/2930541), it is highly recommended using Drush to install this module to prevent a potential time-our error during the installation. Also, you have to make sure you clear the cache after installing this module and then remove the patch from your codebase(composer.json).