CVE-2026-87940

Name of the Vulnerable Software and Affected Versions Drupal Key auth versions 0.0.0 through 2.2.4

Description Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module fails to cache data on a per-user basis, which may allow an attacker with the same permissions to view authentication keys belonging to another user. This issue requires the dynamic page cache module to be enabled to be exploitable.

Recommendations Update Drupal Key auth to a version later than 2.2.4. Disable the dynamic page cache module as a temporary mitigation measure.