Access Control Security Flaw in Drupal Key Authentication
CVE-2026-87940

Currently unrated

Key Information:

Vendor

Drupal
Status
Key Auth
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87940?

A vulnerability in the Key Authentication module of Drupal allows attackers to exploit incorrectly configured access control security levels. This weakness can lead to sensitive information being cached in web browsers, which may be accessed by unauthorized users. Affected versions include Key Authentication from 0.0.0 to 2.2.4, making it critical for administrators to review their access configurations and apply necessary patches to safeguard against potential exploits.

Affected Version(s)

Key auth 0.0.0 < 2.2.4

References

https://www.drupal.org/sa-contrib-2026-138

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Utkarsh Choudhary (sisyphus_ut)
Utkarsh Choudhary (sisyphus_ut)
solideogloria
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.