CVE-2025-48012 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48012 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48012

The Drupal One Time Password module is vulnerable to an Authentication Bypass by Capture-replay vulnerability (CWE-294) in versions 0.0.0 through 1.3.0 . The root cause is that the module does not sufficiently prevent the reuse of the same TFA token within a 30-second window. An attacker who has ...