CVE-2026-87940
This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
This module enables you to add key-based authentication on a per-user
basis.
The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.
This vulnerability is mitigated by the fact that the site must have the dynamic_page_cache module enabled.
Paquets affectés
Packagist:https://packages.drupal.org/8
drupal/key_auth
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4"}],"database_specific":{"constraint":"<2.2.4"}}]
Références
- web drupal.org