CVE-2025-48012

The Drupal One Time Password module is vulnerable to an Authentication Bypass by Capture-replay vulnerability (CWE-294) in versions 0.0.0 through 1.3.0 . The root cause is that the module does not sufficiently prevent the reuse of the same TFA token within a 30-second window. An attacker who has ...

CVE-2025-48010

The Drupal One Time Password module is vulnerable to an Authentication Bypass Using an Alternate Path or Channel vulnerability. This flaw allows for a functionality bypass because the module does not sufficiently prevent one-time login links from bypassing Two-Factor Authentication (TFA). This is...

CVE-2025-48011

The Drupal One Time Password module (versions 0.0.0 through 1.3.0) is vulnerable to an Authentication Bypass Using an Alternate Path or Channel (CWE-288). The root cause is that the module fails to sufficiently prevent Two-Factor Authentication (TFA) from being bypassed when utilizing REST login ...