CVE-2026-84923

MediumCVSS 6.5

Published: 22/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Email Verification / SMS Verification / OTP Verification module for Drupal contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows authentication bypass. This issue affects versions from 0.0.0 to 2.4.0.

Risk Assessment

An attacker could bypass the verification mechanism and gain access to protected resources or accounts without proper authentication.

Recommendation

Update the module to a version newer than 2.4.0 as soon as it becomes available and review logs for suspicious login attempts.

Other vulnerabilities in Drupal Email Verification / SMS Verification / OTP Verification

CVE-2026-84924Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions from 0.0.0 to 2.4.0.

Original NVD description (English source)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS