GHSA-9jrw-jrrj-p6fr

Source

https://github.com/advisories/GHSA-9jrw-jrrj-p6fr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-9jrw-jrrj-p6fr/GHSA-9jrw-jrrj-p6fr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9jrw-jrrj-p6fr

Aliases

CVE-2025-12760

Published

2025-11-18T18:32:52Z

Modified

2025-11-20T14:43:59.105948Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Drupal Email TFA allows Functionality Bypass

Details

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass. This issue affects Email TFA: from 0.0.0 before 2.0.6.

Database specific

{
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-288"
    ],
    "nvd_published_at": "2025-11-18T17:15:58Z",
    "github_reviewed_at": "2025-11-19T18:47:18Z"
}

References

Affected packages

Packagist / drupal/email_tfa

Package

Name: drupal/email_tfa
Purl: pkg:composer/drupal/email_tfa

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.6