{"id":"CVE-2026-87940","aliases":["DRUPAL-CONTRIB-2026-138","EUVD-2026-107861","GHSA-jxp7-mx43-ch9f"],"status":"published","title":"Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00232,"percentile":0.14163,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-525"],"published":"2026-09-09T17:17:50Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/key_auth","fixed_in":["2.2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/key_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4"}]}]}],"products":[{"vendor":"drupal","product":"key auth"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-138","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87940","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jxp7-mx43-ch9f"},{"url":"https://git.drupalcode.org/project/key_auth","tags":["web"]},{"url":"https://www.drupal.org/project/key_auth","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87940.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-87940","title":"Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.","status":"published","published":"2026-10-22T01:22:02.034Z","modified":"2026-10-22T17:20:25.737Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-525"],"updated_at":"2026-11-02T13:37:47.463822Z"}],"euvd":[{"id":"EUVD-2026-107861","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.","status":"published","published":"2026-10-22T01:22:02Z","modified":"2026-10-22T17:20:25Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:34.732609Z"}],"ghsa":[{"id":"GHSA-jxp7-mx43-ch9f","title":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows...","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.","status":"published","published":"2026-10-22T03:33:39Z","modified":"2026-10-22T18:39:23Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-525"],"updated_at":"2026-11-02T15:14:16.981825Z"}],"nvd":[{"id":"CVE-2026-87940","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.","status":"published","published":"2026-10-22T02:17:03.503Z","modified":"2026-10-22T18:17:31.71Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-525"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-87940","title":"Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.","status":"published","published":"2026-10-22T01:22:02.034Z","modified":"2026-10-28T02:30:41.012576117Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-525"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DRUPAL-CONTRIB-2026-138","description":"This module enables you to add key-based authentication on a per-user  \nbasis.\n\nThe module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.\n\nThis vulnerability is mitigated by the fact that the site must have the `dynamic_page_cache` module enabled.","status":"published","published":"2026-09-09T17:17:50Z","modified":"2026-09-09T19:25:58.110775Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}