CVE-2026-87940
CVE-2026-87940 · Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
CVSS 5.4 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
key auth
- Versions
- ≥ 0.0.0, < 2.2.4: Affected (semver)
Update to 2.2.4
drupal/key_auth Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 2.2.4
Update to 2.2.4