PatchClock

PHP security digest · 9 Sep 2026

This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view anot...

Unrated CVE-2026-87940

Package
drupal/key_auth
Fixed in
2.2.4
Published
Wed 9 Sep 2026, 18:17 LisbonUpdated Sun 25 Oct 2026, 23:26 Lisbon

In plain words

The module does not cache per user, so an attacker may be able to view another user's authentication keys if they have the same permissions. The flaw requires the dynamic_page_cache module to be enabled.

Am I affected?

Look for drupal/key_auth and its installed version in composer.lock. Version 2.2.4 is fixed; the advisory does not specify an affected version range. Check whether dynamic_page_cache is enabled and whether an attacker could have the same permissions as another user whose authentication keys are exposed.

What to do

Check which version you have, then update to a fixed release for your branch (2.2.4):

composer show drupal/key_auth | grep versions
composer update drupal/key_auth

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory identifies the requirement for dynamic_page_cache to be enabled as a mitigating condition, but gives no specific workaround steps.

The advisory's description

This module enables you to add key-based authentication on a per-user
basis.

The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.

This vulnerability is mitigated by the fact that the site must have the dynamic_page_cache module enabled.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.