Key Auth
Monthly
The Drupal contrib module Key auth (versions 0.0.0 through 2.2.4) can store sensitive authentication data in the web browser cache because of missing or incorrect cache-control handling, a CWE-525 weakness that also reflects incorrectly configured access-control levels in the module. Low-privilege authenticated users (CVSS PR:L) could recover that cached material over the network, yielding limited confidentiality and integrity impact for a base score of 5.4. Patch data shows a vendor fix is available, EPSS is only 0.15% (4th percentile) and there is no KEV listing; no public exploit identified at time of analysis, and the priority label is this_month rather than immediate action.
The Drupal contrib module Key auth (versions 0.0.0 through 2.2.4) can store sensitive authentication data in the web browser cache because of missing or incorrect cache-control handling, a CWE-525 weakness that also reflects incorrectly configured access-control levels in the module. Low-privilege authenticated users (CVSS PR:L) could recover that cached material over the network, yielding limited confidentiality and integrity impact for a base score of 5.4. Patch data shows a vendor fix is available, EPSS is only 0.15% (4th percentile) and there is no KEV listing; no public exploit identified at time of analysis, and the priority label is this_month rather than immediate action.