{"id":"CVE-2026-84924","kind":"vulnerability","aliases":["CVE-2026-84924"],"related":[],"title":"Drupal Email Verification module: reflected XSS in versions up to 2.4.0","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.","summary":"The Drupal Email Verification / SMS Verification / OTP Verification module fails to neutralize input when it generates a web page, so a crafted link can inject script. An attacker who gets a user to open that link can run script in the victim's browser session.","severity":"medium","cvss":5.4,"epss":0.00181,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Drupal Email Verification / SMS Verification / OTP Verification module with `drush pm:list --filter=email_verification` or the module's info file\n- Confirm whether the installed version is `2.4.0` or older","fix":"- Move the Drupal Email Verification / SMS Verification / OTP Verification module to a version newer than `2.4.0`, as the sources do not name the exact fixed release: unknown","status":"open","published_at":"2026-10-22T02:17:02+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:14:32+00:00","updated_at":"2026-10-25T04:14:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:14:32Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Drupal Email Verification / SMS Verification / OTP Verification module to a version newer than `2.4.0`, as the sources do not name the exact fixed release: unknown","reach":"internet","title":"Drupal Email Verification module: reflected XSS in versions up to 2.4.0","impact":"medium","summary":"The Drupal Email Verification / SMS Verification / OTP Verification module fails to neutralize input when it generates a web page, so a crafted link can inject script. An attacker who gets a user to open that link can run script in the victim's browser session.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a victim's browser on the affected Drupal site","analyst_note":"Confirm the fixed version and the exact trigger path for the reflected XSS in the Drupal security advisory for the Email Verification module.","how_to_check":"- Check the installed version of the Drupal Email Verification / SMS Verification / OTP Verification module with `drush pm:list --filter=email_verification` or the module's info file\n- Confirm whether the installed version is `2.4.0` or older","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Email Verification / SMS Verification / OTP Verification module at version 2.4.0 or older are exposed, since the flaw is in the page the module generates. Sites that do not install this module can skip it. The sources do not say whether the module must be enabled on a specific page or configuration for the issue to trigger: unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000637,"input_tokens":3377,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84924':14A,17A '0.0.0':104C '2.4.0':11A,106C 'affect':95C 'allow':90C 'attack':51B 'browser':67B 'craft':45B 'cross':78C 'cross-sit':77C 'cve':12A,15A 'drupal':1A,18B,25B,83C 'email':2A,26B,84C,96C 'fail':33B 'generat':39B,76C 'get':53B 'host':23B 'improp':69C 'inject':48B 'input':36B,72C 'issu':94C 'link':46B,59B 'modul':4A,32B 'neutral':35B,70C 'open':57B 'otp':30B,88C,100C 'packag':19B 'page':42B,75C 'php':20B 'reflect':5A,91C 'run':61B 'script':49B,62B,80C 'self':22B 'self-host':21B 'session':68B 'site':79C 'sms':28B,86C,98C 'user':55B 'verif':3A,27B,29B,31B,85C,87C,89C,97C,99C,101C 'version':8A,102C 'victim':65B 'vulner':81C 'web':41B,74C 'xss':6A,92C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Email Verification / SMS Verification / OTP Verification module at version 2.4.0 or older are exposed, since the flaw is in the page the module generates. Sites that do not install this module can skip it. The sources do not say whether the module must be enabled on a specific page or configuration for the issue to trigger: unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84924","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84924","severity":null,"published_at":"2026-10-22T02:17:02+00:00","modified_at":"2026-10-22T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84924","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84924","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}