Authentication Bypass Vulnerability in Drupal One Time Password
CVE-2025-48010

4.8MEDIUM

Key Information:

Vendor

Drupal
Status
One Time Password
Vendor
CVE Published:
21 May 2025

What is CVE-2025-48010?

An authentication bypass vulnerability exists in the Drupal One Time Password module due to flawed handling of alternate authentication paths. This weakness allows attackers to bypass intended authentication mechanisms, potentially granting unauthorized access to system functionality. This impacts versions from 0.0.0 up to but not including 1.3.0, necessitating immediate attention from users to prevent exploitation.

Affected Version(s)

One Time Password 0.0.0 < 1.3.0

References

https://www.drupal.org/sa-contrib-2025-061

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Conrad Lara (cmlara)
danielveza
Kim Pepper (kim.pepper)
Lee Rowlands (larowlan)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.