An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
| Vendor | Product | Versions |
|---|---|---|
| drupal | tfa basic plugins | 7.x-1.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | drupal | cert_advisory | 90% |
Updated description with new technical details, changed severity to HIGH, and marked as actively exploited.
Initial creation
