{"id":"CVE-2025-31676","aliases":["DRUPAL-CONTRIB-2025-001","EUVD-2025-9048","GHSA-34w4-3qr3-m637"],"status":"published","title":"Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001","description":"Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00572,"percentile":0.47766,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1390","CWE-307"],"published":"2025-01-08T17:22:11Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/email_tfa","fixed_in":["2.0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/email_tfa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]}],"products":[{"vendor":"drupal","product":"email tfa"},{"vendor":"email_tfa_project","product":"email_tfa"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-001","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31676","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-34w4-3qr3-m637"},{"url":"https://git.drupalcode.org/project/email_tfa","tags":["web"]},{"url":"https://www.drupal.org/project/email_tfa","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31676.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31676","title":"Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001","description":"Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.","status":"published","published":"2025-03-31T21:36:58.56Z","modified":"2025-06-19T22:42:50.725Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-9048","description":"Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.","status":"published","published":"2025-03-31T21:36:58Z","modified":"2025-06-19T22:42:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:19.507179Z"}],"ghsa":[{"id":"GHSA-34w4-3qr3-m637","title":"Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email...","description":"Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.","status":"published","published":"2025-04-01T00:30:33Z","modified":"2025-06-04T15:30:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-307","CWE-1390"],"updated_at":"2026-11-02T15:02:33.897794Z"}],"nvd":[{"id":"CVE-2025-31676","description":"Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.","status":"published","published":"2025-03-31T22:15:20.113Z","modified":"2026-06-17T09:10:45.083Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1390","CWE-307"],"updated_at":"2026-11-02T14:10:56.494516Z"}],"osv":[{"id":"CVE-2025-31676","title":"Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001","description":"Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.","status":"published","published":"2025-03-31T21:36:58.56Z","modified":"2026-10-28T02:30:23.125560239Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"DRUPAL-CONTRIB-2025-001","description":"This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification code to the user's email every time the user tries to log in to your site.\n\nThe module did not sufficiently protect against brute force attacks, allowing an attacker to bypass the second factor.\n\nThis vulnerability is mitigated by the fact the attacker must be able to present the username and first factor (i.e. password).","status":"published","published":"2025-01-08T17:22:11Z","modified":"2026-09-10T03:45:47.242339884Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}