CVE-2025-12760: 
PHP vulnerability analysis and mitigation

Authentication Bypass Using an Alternate Path or Channel vulnerability (CVE-2025-12760) affects Drupal Email TFA module versions from 0.0.0 before 2.0.6. The vulnerability was discovered and disclosed on November 18, 2025, with the last update being November 19, 2025 (NVD).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The root cause lies in the checkTfa method within the EmailTfaSubscriber class, which is triggered on kernel requests to check if two-factor authentication is required. In vulnerable versions, when checkTfa determined that a TFA code was needed, it would send the code via email but would then allow the user's original request to proceed to its destination (Miggo).

The vulnerability allows an attacker with valid username and password credentials to bypass the two-factor authentication mechanism and gain unauthorized access to protected areas without completing the second authentication step (Miggo).

The vulnerability has been patched in version 2.0.6 of the Email TFA module. The fix modifies the checkTfa function to generate a TrustedRedirectResponse to the TFA input form and sets it on the request event, ensuring that users cannot proceed until they have successfully submitted the TFA code (Miggo).