Packagist/drupal/email_tfa CVE-2025-12760: medium 5.4, EPSS 0.21%

The Email TFA module provides additional email-based two-factor authentication for Drupal logins.

Action: Upgrade drupal/email_tfa to 2.0.6 or later.

composer require drupal/email_tfa:2.0.6

Affected

Fixed versions

Sources

• osv: DRUPAL-CONTRIB-2025-115
• nvd: CVE-2025-12760
• https://www.drupal.org/sa-contrib-2025-115

CVE-2025-12760 · published 2025-11-05T18:08:01Z · modified 2026-09-10T03:45:39.018919063Z · JSON