{"id":"CVE-2026-84923","kind":"vulnerability","aliases":["CVE-2026-84923"],"related":[],"title":"Drupal Email/SMS/OTP Verification: authentication bypass via alternate channel","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.","summary":"The Drupal Email Verification / SMS Verification / OTP Verification module has an authentication bypass through an alternate path or channel. The sources say versions from 0.0.0 through 2.4.0 are affected, and an attacker could get past the verification step to log in.","severity":"medium","cvss":6.5,"epss":0.00252,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Drupal module with `drush pm:list --filter=verification` or `composer show drupal/email_verification`\n- unknown for the exact module machine name and whether the affected flow is enabled","fix":"- Update the module to a version later than `2.4.0` once a fixed release is published; the sources do not name the fixed version\n- unknown whether a patch or workaround exists yet","status":"open","published_at":"2026-10-22T02:17:02+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:48:42+00:00","updated_at":"2026-10-25T03:48:42+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:48:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update the module to a version later than `2.4.0` once a fixed release is published; the sources do not name the fixed version\n- unknown whether a patch or workaround exists yet","reach":"internet","title":"Drupal Email/SMS/OTP Verification: authentication bypass via alternate channel","impact":"high","summary":"The Drupal Email Verification / SMS Verification / OTP Verification module has an authentication bypass through an alternate path or channel. The sources say versions from 0.0.0 through 2.4.0 are affected, and an attacker could get past the verification step to log in.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker logs in without completing verification","analyst_note":"Find the advisory with the fixed version and the exact vulnerable flow; check the NVD entry for the CVSS vector.","how_to_check":"- Check the installed version of the Drupal module with `drush pm:list --filter=verification` or `composer show drupal/email_verification`\n- unknown for the exact module machine name and whether the affected flow is enabled","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Email Verification / SMS Verification / OTP Verification module at version `2.4.0` or earlier are in scope. Sites that do not use this module for login or registration verification can skip it. The sources do not say which specific configuration exposes the bypass.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000616,"input_tokens":3365,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-84923':11A,14A '0.0.0':45B,92C '2.4.0':47B,94C 'affect':49B,83C 'allow':78C 'altern':7A,36B,65C 'attack':52B 'authent':4A,32B,61C,79C 'bypass':5A,33B,62C,80C 'channel':8A,39B,68C 'could':53B 'cve':9A,12A 'drupal':1A,15B,22B,71C 'email':23B,72C,84C 'email/sms/otp':2A 'get':54B 'host':20B 'issu':82C 'log':60B 'modul':29B 'otp':27B,76C,88C 'packag':16B 'past':55B 'path':37B,66C 'php':17B 'say':42B 'self':19B 'self-host':18B 'sms':25B,74C,86C 'sourc':41B 'step':58B 'use':63C 'verif':3A,24B,26B,28B,57B,73C,75C,77C,85C,87C,89C 'version':43B,90C 'via':6A 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Email Verification / SMS Verification / OTP Verification module at version `2.4.0` or earlier are in scope. Sites that do not use this module for login or registration verification can skip it. The sources do not say which specific configuration exposes the bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84923","severity":null,"published_at":"2026-10-22T02:17:02+00:00","modified_at":"2026-10-22T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84923","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84923","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}