---
id: "CVE-2026-87940"
kind: "vulnerability"
aliases: ["CVE-2026-87940"]
title: "Drupal Key auth: sensitive data cached in browser, exposed by access control misconfiguration"
severity: "medium"
cvss: 5.4
epss: 0.00183
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["drupal", "php", "runtime", "self-hosted"]
not_affected_if: ["key-auth-not-installed", "no-sensitive-pages-exposed"]
published_at: "2026-10-22T02:17:03+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:14:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87940", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87940", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal Key auth: sensitive data cached in browser, exposed by access control misconfiguration

The Drupal Key auth module can leave sensitive information in the web browser cache. An attacker who can exploit an incorrectly configured access control setting may be able to read that cached data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Key auth version with `drush pm:list --filter=key_auth` or in the Drupal admin under Extend; unknown whether other checks apply
- Review access control settings for the Key auth module and the pages it protects; unknown what exact setting is involved

## Fix

- Upgrade the Drupal Key auth module to a version later than `2.2.4`; the first fixed version is unknown from the sources
- Review access control and cache headers on authenticated pages; unknown what specific change is required

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87940
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87940

## From the sources

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_