Executive brief
The Drupal TFA Basic Plugins module, which provides two-factor authentication (2FA) for Drupal 7 websites, contains a security flaw in how it manages user permissions. An administrative user with general user management privileges can bypass security boundaries to view or generate 2FA recovery codes and setup data for other users. This could allow a privileged user to compromise the secondary authentication layer of other accounts, potentially leading to unauthorized account access.
Technical details
An access bypass vulnerability exists in the Drupal 7 TFA Basic Plugins module due to insufficient validation of user permissions on sensitive routes. Specifically, the module's route access logic allows users with the 'administer users' permission to access cross-account paths such as /user/{uid}/security/tfa/app-setup and /recovery-codes-list. By providing their own password when challenged, an administrative attacker can view another user's TOTP seeds, QR codes, or recovery codes. This breaks the expected isolation between user authentication factors. The issue is fixed in version 7.x-1.3 (and NES version 7.1.3) by restricting these setup and recovery actions strictly to the account owner.
Affected products
- Drupal TFA Basic Plugins 7.x-1.0 through 7.x-1.2
Timeline
- 2025-08-20: advisory: Original Drupal security advisory SA-CONTRIB-2025-085 published
- 2025-08-20: patched: Version 7.x-1.3 released
- 2026-05-28: disclosed: CVE-2026-6816 published to NVD