CVE-2025-48011

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48011 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48011

The Drupal One Time Password module (versions 0.0.0 through 1.3.0) is vulnerable to an Authentication Bypass Using an Alternate Path or Channel (CWE-288). The root cause is that the module fails to sufficiently prevent Two-Factor Authentication (TFA) from being bypassed when utilizing REST login ...