—
DRUPAL-CONTRIB-2025-115
Details
The Email TFA module provides additional email-based two-factor authentication for Drupal logins.
In certain scenarios, the module does not fully protect all login mechanisms as expected.
This issue is mitigated by the fact that an attacker must already have valid user credentials (username and password) to take advantage of the weakness.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/email_tfa
Introduced in:
0Fixed in: 2.0.6Upgrade drupal/email_tfa to 2.0.6 or newer (ecosystem packagist:https://packages.drupal.org/8).