CVE-2025-12760: 
PHP vulnerability analysis and mitigation

CVE-2025-12760 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the Drupal Email TFA (Two-Factor Authentication) module that allows authenticated low-privilege users to bypass the two-factor authentication mechanism. It affects all versions of the Email TFA module from 0.0.0 up to (but not including) version 2.0.6. The vulnerability was published on November 18, 2025, with a patch released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Drupal Advisory).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning the Email TFA module fails to enforce two-factor authentication across all available authentication paths or channels. An attacker with low-level network access (i.e., a valid account with minimal privileges) can exploit an alternate code path that does not require completion of the email-based TFA challenge, effectively bypassing the second authentication factor. No user interaction is required, and attack complexity is low, making exploitation straightforward for any authenticated user (GitHub Advisory, Drupal Advisory).

Successful exploitation allows a low-privilege attacker to bypass the email-based two-factor authentication requirement, gaining unauthorized access to accounts or functionality that should be protected by TFA. This results in limited confidentiality and integrity impacts — an attacker could access restricted information and potentially modify data they would not otherwise be authorized to interact with. Availability is not impacted. The risk is most significant in environments where TFA is the primary additional security control protecting sensitive accounts or administrative functions (GitHub Advisory).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been observed as of the time of this report. The EPSS score is approximately 0.037–0.046%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privilege authenticated account, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Drupal Advisory).

The primary remediation is to upgrade the Drupal Email TFA module to version 2.0.6 or later, which was released on November 18, 2025. Site administrators should audit authentication logs for any suspicious login activity that bypassed TFA prior to patching. As an interim measure, consider enforcing additional access controls (e.g., IP allowlisting for sensitive accounts) or temporarily disabling the Email TFA module if upgrading is not immediately possible (Drupal Advisory, GitHub Advisory).