{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c2.2.4"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/key_auth"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c2.2.4"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-87940"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/sisyphus_ut"
      ],
      "name": "Utkarsh Choudhary (sisyphus_ut)"
    }
  ],
  "details": "This module enables you to add key-based authentication on a per-user  \nbasis.\n\nThe module doesn\u0027t cache per user, potentially allowing an attacker to view another user\u0027s authentication keys, if the attacker has the same permissions.\n\nThis vulnerability is mitigated by the fact that the site must have the `dynamic_page_cache` module enabled.",
  "id": "DRUPAL-CONTRIB-2026-138",
  "modified": "2026-09-09T17:17:50.000Z",
  "published": "2026-09-09T17:17:50.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-138"
    }
  ],
  "schema_version": "1.7.0"
}