CVE-2026-87940: Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Q: Which installations are in the affected version range?

Drupal Key auth installations running versions from 0.0.0 through 2.2.4 are affected.

Q: What configuration condition is relevant to exploitation?

The issue involves incorrectly configured access-control security levels and sensitive information retained in a web browser cache. Review access-control settings and browser caching behavior for sensitive content.

Published Oct 22, 2026

Updated

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

Affected Software

1 affected component

Drupal Key auth>=0.0.0<=2.2.4

Event History

Oct 22, 2026

CVE Published

via MITRE·01:22 AM

Data Sourced

via MITRE·01:22 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are in the affected version range?

Drupal Key auth installations running versions from 0.0.0 through 2.2.4 are affected.

What configuration condition is relevant to exploitation?

The issue involves incorrectly configured access-control security levels and sensitive information retained in a web browser cache. Review access-control settings and browser caching behavior for sensitive content.

CVE-2026-87940: Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Affected Software

Event History

Frequently Asked Questions

Which installations are in the affected version range?

What configuration condition is relevant to exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are in the affected version range?

What configuration condition is relevant to exploitation?