Email Login OTP CVE-2026-16642

Exploitation requires an authenticated session with high administrative privileges on the target Drupal site - the CVSS vector PR:H confirms this. Additionally, user interaction (UI:R) is required, meaning a separate user must be performing some action within the authentication flow concurrently or in response to attacker-controlled conditions. Attack complexity is high (AC:H), indicating that specific conditions beyond just access must align. The Email Login OTP module must be installed and enabled on the target site; default Drupal installations without this contributed module are not affected. Limiting factors include: the PR:H requirement (attacker must already control a high-privilege account), the UI:R requirement (passive exploitation is not possible), and AC:H (reliable exploitation is not straightforward). These constraints significantly reduce the realistic threat surface beyond the raw CVSS C:H/I:H impact values.

Despite SSVC reporting 'total' technical impact - suggesting full compromise of the affected system if exploited - the other signals collectively indicate low real-world urgency. The CVSS score of 5.7 (Medium) reflects the constraining factors: Attack Complexity is High (AC:H), Privileges Required is High (PR:H), and User Interaction is required (UI:R), meaning exploitation is not straightforward and cannot be automated at scale (consistent with SSVC Automatable: no). EPSS at 0.14% (4th percentile) strongly suggests no current exploitation activity and minimal threat actor interest. There is no CISA KEV listing and no public exploit code identified. The discrepancy between SSVC's 'total' technical impact and the medium CVSS score is notable: it reflects that IF exploitation succeeds under the required conditions, the authentication integrity and confidentiality impact is severe, but reaching those conditions is non-trivial. This is not a fire-drill priority - patch during normal change windows rather than emergency response.

A threat actor who has already obtained high-privilege (administrator-level) access to a Drupal site running Email Login OTP could craft malformed or boundary-violating input within the OTP authentication flow, potentially triggering improper validation behavior that exposes OTP token data or manipulates authentication state for another user. The attack requires the victim user to interact with the authentication system during the exploit window, limiting opportunistic exploitation. No public proof-of-concept code has been identified at time of analysis.