The vulnerability is a misuse of web browser cache containing sensitive information within Drupal Key auth. Because the module does not enforce proper access controls when caching data, an attacker can read cached authentication data that should only be viewable by the authenticated user. This can result in unauthorized disclosure of credentials or other sensitive information that could be used for account takeover or data leakage.

All Drupal Key auth installations running a module version from 0.0.0 up to and including 2.2.4 are affected, regardless of the Drupal core version. The issue applies to any site where the module is enabled and browser caching of authentication data is active.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. The EPSS score is below 1%, suggesting a low exploitation probability, and it is not flagged in the CISA KEV catalog. Based on the description, the attack likely requires a client‑side payload or a socially engineered web page that causes the victim’s browser to access the cached authentication data. While the attack vector is relatively limited, the potential impact of leaking sensitive credentials warrants prompt remediation.