---
id: "CVE-2026-84923"
kind: "vulnerability"
aliases: ["CVE-2026-84923"]
title: "Drupal Email/SMS/OTP Verification: authentication bypass via alternate channel"
severity: "medium"
cvss: 6.5
epss: 0.00252
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:02+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:48:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84923", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-84923", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal Email/SMS/OTP Verification: authentication bypass via alternate channel

The Drupal Email Verification / SMS Verification / OTP Verification module has an authentication bypass through an alternate path or channel. The sources say versions from 0.0.0 through 2.4.0 are affected, and an attacker could get past the verification step to log in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Drupal module with `drush pm:list --filter=verification` or `composer show drupal/email_verification`
- unknown for the exact module machine name and whether the affected flow is enabled

## Fix

- Update the module to a version later than `2.4.0` once a fixed release is published; the sources do not name the fixed version
- unknown whether a patch or workaround exists yet

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84923
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-84923

## From the sources

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_