{"id":"CVE-2025-12760","aliases":["DRUPAL-CONTRIB-2025-115","EUVD-2025-198026","GHSA-9jrw-jrrj-p6fr"],"status":"published","title":"Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0021,"percentile":0.11345,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288"],"published":"2025-11-05T18:08:01Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Packagist","package":"drupal/email_tfa","fixed_in":["2.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/email_tfa","fixed_in":["2.0.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/email_tfa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/email_tfa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/email_tfa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}]}],"products":[{"vendor":"drupal","product":"email tfa"},{"vendor":"email_tfa_project","product":"email_tfa"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-115","tags":["Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12760","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9jrw-jrrj-p6fr"},{"url":"https://git.drupalcode.org/project/email_tfa","tags":["web","package"]},{"url":"https://www.drupal.org/project/email_tfa","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12760.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-12760","title":"Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.","status":"published","published":"2025-11-18T16:55:59.017Z","modified":"2025-11-18T20:30:29.114Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-198026","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.","status":"published","published":"2025-11-18T16:55:59Z","modified":"2025-11-18T20:30:29Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:15.806163Z"}],"ghsa":[{"id":"GHSA-9jrw-jrrj-p6fr","title":"Drupal Email TFA allows Functionality Bypass","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass. This issue affects Email TFA: from 0.0.0 before 2.0.6.","status":"published","published":"2025-11-18T18:32:52Z","modified":"2025-11-19T18:47:20Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"nvd":[{"id":"CVE-2025-12760","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.","status":"published","published":"2025-11-18T17:15:58.383Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:11:44.669367Z"}],"osv":[{"id":"CVE-2025-12760","title":"Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.","status":"published","published":"2025-11-18T16:55:59.017Z","modified":"2026-10-28T02:31:05.864138959Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"GHSA-9jrw-jrrj-p6fr","title":"Drupal Email TFA allows Functionality Bypass","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass. This issue affects Email TFA: from 0.0.0 before 2.0.6.","status":"published","published":"2025-11-18T18:32:52Z","modified":"2025-12-10T23:40:56.859407Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"DRUPAL-CONTRIB-2025-115","description":"The Email TFA module provides additional email-based two-factor authentication for Drupal logins.\n\nIn certain scenarios, the module does not fully protect all login mechanisms as expected.\n\nThis issue is mitigated by the fact that an attacker must already have valid user credentials (username and password) to take advantage of the weakness.","status":"published","published":"2025-11-05T18:08:01Z","modified":"2026-09-10T03:45:39.018919063Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}