CVE-2026-84924: Drupal OTP Verification Module Unauthenticated Reflected XSS Vulnerability
Summary
CVE-2026-84924: This module enables you to add an extra layer of verification for user registration. Affects drupal/otp_verification versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal OTP Verification module provides an additional layer of verification for user registration processes. It allows site administrators to enhance security by requiring users to verify their identity through one-time passwords. However, this module has been found to have a critical vulnerability that can be exploited if user input is not properly sanitized.
Vulnerability Detail
The vulnerability arises from the module's failure to adequately filter user-supplied input before outputting it to the web page. This oversight leads to an unauthenticated reflected Cross-site Scripting (XSS) vulnerability, which can be exploited by attackers to inject malicious scripts into web pages viewed by other users. The ramifications of this vulnerability include potential data theft, session hijacking, and unauthorized actions performed on behalf of users.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, site administrators can limit user input to known safe values and implement additional input validation to reduce the risk of XSS attacks until the module is updated.
Conclusion
The Drupal OTP Verification module has a critical vulnerability that can lead to serious security risks. It is essential for users of the module to update to the latest version to protect their applications from potential exploits. Additionally, temporary workarounds can help reduce risk until the update is applied.
See every vulnerability recorded for drupal/otp_verification →
FAQ
The vulnerability is an unauthenticated reflected Cross-site Scripting (XSS) issue due to insufficient input filtering.
Any site using the Drupal OTP Verification module version prior to 2.4.0 is at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to data theft, session hijacking, and unauthorized actions on behalf of users.
Yes, implementing strict input validation and limiting user input to safe values can help mitigate the risk temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/otp_verification.
