CVE-2025-12760
CVE-2025-12760 · Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.
CVSS 5.4 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
email tfa
- Versions
- ≥ 0.0.0, < 2.0.6: Affected (semver)
Update to 2.0.6
drupal/email_tfa Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 2.0.6
Update to 2.0.6
drupal/email_tfa Packagist
- Affected ranges
- ECOSYSTEM: < 2.0.6
Update to 2.0.6