DRUPAL-CONTRIB-2026-305

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/reset_password_email_otp/DRUPAL-CONTRIB-2026-305.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-305

Aliases

CVE-2026-122074

Published

2026-11-04T17:34:48Z

Modified

2026-11-04T20:30:03Z

Summary

[none]

Details

This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links.

The module doesn't sufficiently validate resetting passwords for blocked users.

This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password.

References

https://www.drupal.org/sa-contrib-2026-305

Credits

- Scott Euser (scott_euser)
- - https://www.drupal.org/u/scott_euser

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/reset_password_email_otp

Package

Name: drupal/reset_password_email_otp
Purl: pkg:composer/drupal/reset_password_email_otp?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

1.0.5

Database specific

Show details

{
    "constraint": "<1.0.5"
}

Database specific

affected_versions

"<1.0.5"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/reset_password_email_otp/DRUPAL-CONTRIB-2026-305.json"