{"action":"Upgrade drupal/email_tfa to 2.0.3 or later.","affected":[{"fixed":"2.0.3","introduced":"2.0.0"}],"component":"drupal/email_tfa","cve_ids":["CVE-2025-31676"],"ecosystem":"Packagist","ecosystem_qualifier":"Packagist:https://packages.drupal.org/8","epss":0.00572,"exploited":false,"fixed_versions":["2.0.3"],"id":"tcs_01M5MF7JAYBFFPRRDKXEKNC8HD","modified_at":"2026-09-10T03:45:47.242339884Z","published_at":"2025-01-08T17:22:11Z","references":["https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-001","https://www.drupal.org/sa-contrib-2025-001"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"DRUPAL-CONTRIB-2025-001","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-001"},{"source":"nvd","source_id":"CVE-2025-31676","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31676"}],"summary":"This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification code to the user's email every time the user tries to log in to your site."}