CVE-2026-122074DRUPAL-CONTRIB-2026-305
This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links.
The module doesn't sufficiently validate resetting passwords for blocked users.
This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
| Product | Affected versions | Fixed in | Source |
|---|---|---|---|
| drupal/reset_password_email_otpPackagist:https://packages.drupal.org/8 | < 1.0.5 | 1.0.5 | OSV |
No weakness classification (CWE) has been assigned yet.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security