PUBLISHED
2025-11-18 17:15
MODIFIED
2025-11-18 17:15
EPSS (Prob. Exploit)
0.21%
Top 88.7%
> DESCRIPTION
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-288: Authentication Bypass Using an Alternate Path or Channel - The product requires authentication, but the product has an alternate path or channel that does not require authentication.
> GITHUB SECURITY ADVISORY
GHSA-9jrw-jrrj-p6fr
MODERATE
Drupal Email TFA allows Functionality Bypass
AFFECTED PACKAGES:
COMPOSER / drupal/email_tfa
< 2.0.6
Fixed in: 2.0.6
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115
AFFECTED PACKAGES:
Unknown / Unknown
14 versions affected
ALIASES:
DRUPAL-CONTRIB-2025-115, GHSA-9jrw-jrrj-p6fr
> HISTORIQUE DES MODIFICATIONS
Première apparition
18/11/2025 17:15
Source: NVD
📊
ENRICHISSEMENT
19/01/2026 17:37
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/12/2025 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-288: Authentication Bypass Using an Alternate Path or Channel - The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Total des modifications: 2
Dernière mise à jour: 9 months ago