BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-12-08

Assigner: Drupal.org

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12760

Affected Vendors & Products

Vendor	Product	Version / Range
email_tfa_project	email_tfa	to 2.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authentication Bypass Using an Alternate Path or Channel in the Drupal Email TFA module. It allows attackers to bypass the intended two-factor authentication functionality, potentially gaining unauthorized access.

Impact Analysis

This vulnerability can allow attackers to bypass two-factor authentication, potentially leading to unauthorized access to user accounts and sensitive information.

Hi! I’m here to help you understand CVE-2025-12760. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70