CVE-2026-6816
TFA Basic Plugins - Access Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
11th
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
| CWE | CWE-267 |
| Vendor | drupal |
| Product | tfa basic plugins |
| Ecosystems | |
| Industries | WebMedia |
| Published | May 28, 2026 |
| Last Updated | May 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for drupal tfa basic plugins
Be the first to know when new unknown vulnerabilities affecting drupal tfa basic plugins are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Drupal / TFA Basic Plugins
7.x-1.0 ≤ 7.x-1.2