—
DRUPAL-CONTRIB-2026-138
Details
This module enables you to add key-based authentication on a per-user basis.
The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.
This vulnerability is mitigated by the fact that the site must have the `dynamic_page_cache` module enabled.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/key_auth
Introduced in:
0Fixed in: 2.2.4Upgrade drupal/key_auth to 2.2.4 or newer (ecosystem packagist:https://packages.drupal.org/8).