Drupal Key auth EUVD-2026-107861

Exploitation requires the Key auth module (versions 0.0.0 up to but not including 2.2.4) to emit responses carrying sensitive authentication data that are stored in the web browser cache due to missing or incorrect cache-control directives, combined with incorrectly configured access-control security levels as noted in the advisory. A realistic attack further requires access to that cached data - for example a shared, public, or multi-user endpoint, or an intermediary cache - and the victim having held an authenticated (PR:L) session that produced the sensitive response. Limiting factors: the attacker needs some authenticated/low-privilege context and physical or logical access to the cache store, which materially narrows exploitation beyond what the raw AV:N network vector implies; sites on patched version 2.2.4 or later are not affected.

This is a moderate-severity information-disclosure issue (CVSS 5.4) in the Drupal contrib module 'Key auth', and the signals consistently point to low real-world urgency rather than an emergency. The vendor-supplied CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) describes an authenticated (PR:L) attacker with limited confidentiality and integrity impact. EPSS is very low at 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit is identified - all of which argue against active or widespread exploitation. The vuln.today decision label is 'this_month', i.e. routine patch prioritization, not act_now/emergency. One signal to flag explicitly: the CWE is CWE-525 (Use of Web Browser Cache Containing Sensitive Information), which is inherently about data persisted in a client-side (or intermediary) cache, yet the CVSS vector asserts AV:N with no user interaction - the network vector and the browser-cache mechanism are in tension, since realistic exploitation depends on access to the cached data rather than a purely remote request; verify the exact trigger with the Drupal advisory. The assigned I:L (integrity) impact is also questionable for a pure cache-disclosure weakness and should be confirmed against the advisory. Net: a real but low-priority bug suited to normal monthly patching.

A Drupal site using the Key auth module returns responses containing sensitive authentication material (such as API keys) without cache-control headers that prevent storage, so the data is retained in the web browser cache. On a shared or public computer, or where an intermediary cache is involved, a subsequent party with access to that cache could recover the sensitive values after the authenticated user has left. No public exploit code has been identified at the time of analysis.