Cross-site Scripting Vulnerability in Drupal Email Verification and OTP Verification Tools
CVE-2026-84924

Currently unrated

Key Information:

Vendor

Drupal
Status
Email Verification / Sms Verification / Otp Verification
Vendor
CVE Published:
22 October 2026

What is CVE-2026-84924?

A cross-site scripting (XSS) vulnerability has been identified in the Drupal Email Verification, SMS Verification, and OTP Verification tools, allowing attackers to execute arbitrary scripts in the context of the user's browser. This can lead to unauthorized access to sensitive information or manipulation of web sessions. The vulnerability affects versions from 0.0.0 to 2.4.0, making it crucial for users to upgrade to secure versions to mitigate this risk.

Affected Version(s)

Email Verification / SMS Verification / OTP Verification 0.0.0 < 2.4.0

References

https://www.drupal.org/sa-contrib-2026-125

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Mohammed Hisam (hisam45)
Drew Webber (mcdruid)
Sudhanshu Dhage (sudhanshu0542)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
.