PT-2025-13840 · Drupal · Drupal Email Tfa

Abdulaziz Zaid + 3 · Published 2025-03-31 · Updated 2025-06-04 · CVE-2025-31676

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal Email TFA versions 0.0.0 through 2.0.2

Description The issue is related to weak authentication in Drupal Email TFA, allowing brute force attacks.

Recommendations For versions 0.0.0 through 2.0.2, update to version 2.0.3 or later to resolve the issue.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-1390

Related Identifiers

CVE-2025-31676

DRUPAL-CONTRIB-2025-001

Affected Products

Drupal Email Tfa

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-31676 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31676 · Vendor Advisory
• https://drupal.org/sa-contrib-2025-001 · Vendor Advisory
• https://t.me/cvenotify/117106 · Telegram Post
• https://twitter.com/dailycve/status/1930298175924928983 · Twitter Post
• https://twitter.com/CVEnew/status/1906826478135787695 · Twitter Post