Authentication Bypass Vulnerability in Drupal One Time Password
CVE-2025-48011

4.8MEDIUM

Key Information:

Vendor

Drupal
Status
One Time Password
Vendor
CVE Published:
21 May 2025

What is CVE-2025-48011?

The Drupal One Time Password plugin is affected by an authentication bypass issue that allows unauthorized access via an alternate path. Versions prior to 1.3.0 are susceptible, enabling attackers to potentially bypass the intended security measures. This vulnerability poses a risk by allowing unauthorized functions to be executed, thereby compromising application integrity.

Affected Version(s)

One Time Password 0.0.0 < 1.3.0

References

https://www.drupal.org/sa-contrib-2025-062

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Conrad Lara (cmlara)
danielveza
Kim Pepper (kim.pepper)
Lee Rowlands (larowlan)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.