CVE-2026-84923 in Email Verification SMS Verification OTP Verification
Summary
by MITRE • 10/22/2026
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability represents a critical authentication bypass flaw within the Drupal Email Verification, SMS Verification, and One-Time Password (OTP) verification modules, specifically affecting version ranges from initial releases up through version 2.4.0. This security defect is categorized under CWE-287, which denotes Improper Authentication, and more specifically aligns with ATT&CK technique T1078, Valid Accounts, as it allows an attacker to circumvent the intended multi-factor or secondary verification mechanisms that are supposed to enforce strict identity validation. The core of this vulnerability lies in the application's failure to properly validate authentication tokens or session states when alternative pathways for user identification are utilized, such as direct API calls, background processes, or non-standard HTTP methods that bypass the primary web interface login flow.
In a typical secure implementation, verification modules like those handling email confirmation codes, SMS-based one-time passwords, and OTP challenges must ensure that every step of the authentication lifecycle is tightly coupled with session integrity checks. However, in the affected versions, there exists an alternate path or channel through which these verification steps can be manipulated or skipped entirely. For instance, an attacker might exploit a race condition where the state indicating successful verification is set before the actual token validation occurs, or they may interact directly with backend endpoints that accept verification requests without requiring the initial session context established by the primary login page. This architectural weakness allows malicious actors to bypass the requirement for valid credentials entirely, effectively treating unauthenticated users as fully verified and authorized entities within the application's logic.
The operational impact of this vulnerability is severe, granting unauthorized access to user accounts with potentially elevated privileges depending on the role assigned to the targeted account. Since Drupal serves as a robust content management system often used by enterprises for sensitive data storage and public-facing services, an authentication bypass can lead to full site compromise. Attackers could manipulate administrative settings, inject malicious code into themes or modules, exfiltrate user databases containing personally identifiable information, or deface websites. Furthermore, because the vulnerability affects multiple verification methods including SMS and OTP which are often perceived as more secure than simple password entry, it undermines trust in multi-factor authentication implementations across a significant portion of the Drupal ecosystem running these specific module versions.
Mitigation strategies must prioritize immediate remediation by upgrading all affected modules to version 2.4.1 or later where this logic flaw has been corrected. In scenarios where an upgrade is not immediately feasible due to compatibility constraints, administrators should implement compensating controls such as strict rate limiting on verification endpoints to prevent brute-force attacks that might exploit the bypass window, and enforce IP-based restrictions for administrative actions if possible. Additionally, security monitoring tools should be configured to detect anomalous login patterns, particularly those involving rapid succession of verification requests or logins originating from unexpected geographic locations without prior standard authentication steps. Regular penetration testing focusing on alternative access channels and session management flaws is also recommended to ensure no similar bypass vectors exist in custom integrations or third-party modules interacting with the core Drupal authentication system.