CVE-2026-87940
This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to...
Original description
The description as published by the source.
This module enables you to add key-based authentication on a per-user
basis.
The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.
This vulnerability is mitigated by the fact that the site must have the dynamic_page_cache module enabled.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/key_auth
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4"}],"database_specific":{"constraint":"<2.2.4"}}]
References
- web drupal.org