SA-CONTRIB-2026-138: Critical severity drupal/key_auth vulnerability
This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must have the dynamicpagecache module enabled.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/key_authto a version that resolves this vulnerability.Fixed in 2.2.4 - Compensating control
Mitigation requires the site to have the 'dynamic_page_cache' module enabled (as stated: 'This vulnerability is mitigated by the fact that the site must have the dynamic_page_cache module enabled.').
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Exposure requires the dynamic_page_cache module to be enabled. The issue can allow users with the same permissions to see another user's authentication keys.
What level of access would an attacker need?
An attacker would need the same permissions as the user whose authentication keys they may be able to view.