Project: 
Key auth
Date: 
2026-September-09
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Access bypass
Affected versions: 
<2.2.4
CVE IDs: 
CVE-2026-87940
Description: 

This module enables you to add key-based authentication on a per-user
basis.

The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.

This vulnerability is mitigated by the fact that the site must have the dynamic_page_cache module enabled.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: