CVE-2025-12760: Email Tfa Project Email Tfa

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.

Affected products

• Email Tfa Project Email Tfa: before 2.0.6 (fixed in 2.0.6)

Published 2025-11-18. Last modified 2026-06-17.