CVE-2025-48011

CVE-2025-48011 affects the Drupal One Time Password module. The connected documents specify an authentication bypass in the module, caused by a vulnerability in the Drupal One Time Password implementation that allows bypassing authentication via an alternate path or channel. Affected versions are...

CVE-2025-48011 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48010 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48010

CVE-2025-48010 describes an authentication bypass in the Drupal One Time Password module. Affected versions are 0.0.0 through 1.3.0, where an alternate path or channel could bypass normal authentication, effectively bypassing functionality. The issue is documented across multiple trusted sources ...

CVE-2025-48010 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

Drupal One Time Password 安全漏洞

Drupal One Time Password is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal One Time Password versions prior to 1.3.0 that stems from bypassing authentication using an alternate path or channel, which could lead to...

WordPress plugin DIGITS 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-22388 · Drupal · Drupal One Time Password

Name of the Vulnerable Software and Affected Versions: Drupal One Time Password versions 0.0.0 through 1.3.0 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password, allowing functionality bypass. Recommendations:...

PT-2025-22389 · Drupal · Drupal One Time Password

Name of the Vulnerable Software and Affected Versions: Drupal One Time Password versions 0.0.0 through 1.3.0 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password, allowing functionality bypass. Recommendations:...

PT-2025-22390 · Drupal · One Time Password

Name of the Vulnerable Software and Affected Versions: One Time Password versions 0.0.0 through 1.3.0 Description: The issue is related to an Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password, allowing remote services with stolen credentials. Recommendations: For O...

Drupal One Time Password 安全漏洞

Drupal One Time Password is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal One Time Password versions prior to 1.3.0 that stems from bypassing authentication using an alternate path or channel, which could lead to...

WordPress Digits OTP Authentication Bypass

WordPress Digits plugin versions prior to 8.4.6.1 suffer from an OTP authentication bypass vulnerability...

DRUPAL-CONTRIB-2025-061

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent one time login links from bypassing TFA. This vulnerability is mitigated by the fact that an attacker must have access to an email accou...

Drupal One Time Password module < 1.3.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module One Time Password versions 1.3.0...

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent one time login links from bypassing TFA. This vulnerability is mitigated by the fact that an attacker must have access to an email accou...

Drupal One Time Password module < 1.3.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module One Time Password versions 1.3.0...

Drupal One Time Password module < 1.3.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module One Time Password versions 1.3.0...

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent TFA from being bypassed when using the REST login routes. A new requirements check has been added to the status report so other...

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent the same TFA token within a 30 second window. This vulnerability is mitigated by the fact that an attacker must obtain a valid...

Cryptography without Long-Term Quantum Memory and Global Entanglement: Classical Setups for One-Time Programs, Copy Protection, and Stateful Obfuscation

We show how oracles which only allow for classical query access can be used to construct a variety of quantum cryptographic primitives which do not require long-term quantum memory or global entanglement. Specifically, if a quantum party can execute a semi-quantum token scheme Shmueli 2022 with...