CVE-2026-84923: Account Takeover Vulnerability in Drupal OTP Verification Module
Summary
CVE-2026-84923: This module enables you to add extra layer of verification for user registration. Affects drupal/otp_verification versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal OTP Verification module is designed to enhance user registration by adding an extra layer of verification through one-time passwords (OTPs). This module is widely used in Drupal applications to ensure that user accounts are created securely. However, it has been identified that the module does not adequately validate user-supplied input, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from insufficient validation of user input within the OTP Verification module. This flaw can be exploited by attackers to take over user accounts, as they may bypass the intended verification process. The ramifications of this vulnerability are significant, as it could lead to unauthorized access to user accounts, compromising sensitive information and undermining the integrity of the application.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional input validation checks in your application code to mitigate the risk of account takeover until the module is updated. However, this is not a permanent solution and updating the module is strongly recommended.
Conclusion
The CVE-2026-84923 vulnerability in the Drupal OTP Verification module poses a serious risk of account takeover due to inadequate input validation. It is crucial for users of this module to update to version 2.4.0 or later to safeguard their applications. Monitoring tools like Vulert can assist in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for drupal/otp_verification →
FAQ
The vulnerability is an account takeover issue caused by insufficient validation of user input in the OTP Verification module.
If you are using a version of the OTP Verification module prior to 2.4.0, your application is at risk. You can use Vulert to check for vulnerabilities in your application.
Attackers could exploit this vulnerability to gain unauthorized access to user accounts, leading to data breaches and loss of user trust.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, implement additional input validation in your application as a temporary measure until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/otp_verification.
