Authentication Bypass Vulnerability in Drupal One Time Password
CVE-2025-48012

4.8MEDIUM

Key Information:

Vendor

Drupal
Status
One Time Password
Vendor
CVE Published:
21 May 2025

What is CVE-2025-48012?

The vulnerability presents an authentication bypass issue in the Drupal One Time Password module, allowing remote services to exploit stolen credentials. This security flaw, affecting versions prior to 1.3.0, can lead to unauthorized access to sensitive information.

Affected Version(s)

One Time Password 0.0.0 < 1.3.0

References

https://www.drupal.org/sa-contrib-2025-063

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Conrad Lara (cmlara)
danielveza
Lee Rowlands (larowlan)
Ivo Van Geertruyen (mr.baileys)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.