CVE-2026-87940

Full vulnerability record from the local CVENow database.

Description

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

Severity

MEDIUM

CVSS score

5.4 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-22 02:17:03.503000

Last modified

2026-10-22 18:17:31.710000

View original CVE JSON

{
  "id": "CVE-2026-87940",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-22T02:17:03.503",
  "lastModified": "2026-10-22T18:17:31.710",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Drupal",
          "product": "Key auth",
          "collectionURL": "https://www.drupal.org/project/key_auth",
          "repo": "https://git.drupalcode.org/project/key_auth",
          "versions": [
            {
              "version": "0.0.0",
              "lessThan": "2.2.4",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-22T17:20:22.605001Z",
          "id": "CVE-2026-87940",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-525"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2026-138",
      "source": "[email protected]"
    }
  ]
}