CVE-2026-6816

LOW 3.8CVE-2026-6816 · Published 28/05/2026 · updated 21/07/2026

In short

CVE-2026-6816 is a LOW (CVSS 3.8) vulnerability affecting tfa basic plugins (tfa basic plugins project).
Chance of exploitation in the next 30 days (EPSS): 0.32%, higher than 25.2% of all vulnerabilities.
Fix: update to 7.x-1.3 or later.

Package	Affected versions	Patched versions
tfa basic plugins tfa_basic_plugins_project	`≥ 7.x-1.0, < 7.x-1.3`	`7.x-1.3`

Description

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.

References

d7es.tag1.com/security-advisories/tfa-basic-plugins-less-critical-access-bypass-sa-contrib-2025-085 · Third Party Advisory
herodevs.com/vulnerability-directory/cve-2026-6816 · Exploit
herodevs.com/vulnerability-directory/cve-2026-6816 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free