PT-2025-47342 · Drupal · Drupal Email Tfa

Abdulaziz Zaid + 3 · Published 2025-11-18 · Updated 2025-12-08 · CVE-2025-12760

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Email TFA versions prior to 2.0.6

Description An authentication bypass issue exists in Drupal Email TFA, allowing functionality bypass through an alternate path or channel. The issue impacts the Email TFA module.

Recommendations Update to version 2.0.6 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-12760

DRUPAL-CONTRIB-2025-115

GHSA-9JRW-JRRJ-P6FR

Affected Products

Drupal Email Tfa

References · 5

• https://drupal.org/sa-contrib-2025-115 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12760 · Security Note
• https://t.me/cveNotify/145126 · Telegram Post
• https://twitter.com/CVEnew/status/1991042979943915657 · Twitter Post