Drupal Email Verification CVE-2026-84924

Exploitation requires an attacker to deliver a crafted URL that the module reflects back into a generated web page without proper neutralization, and the targeted victim must actively open that link in a browser (UI:R) - this user-interaction requirement is the primary limiting factor. The specific parameter, page, or form field that reflects attacker input is not described in the available sources. No authentication is required of the attacker (PR:N), but impact is bounded to the victim's own browser session and privileges in the Drupal site. The flaw is present across all versions from 0.0.0 up to (but not including) 2.4.0 of the Email Verification / SMS Verification / OTP Verification module; sites running 2.4.0 or later per the vendor patch are not affected.

This is a moderate-severity reflected cross-site scripting flaw (CWE-79) in the Drupal contrib module 'Email Verification / SMS Verification / OTP Verification', scoped as CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). The signals are internally consistent and point to a low-to-moderate real-world priority rather than an emergency: the network vector with no privileges required (PR:N) is offset by the mandatory user interaction (UI:R), which means an attacker must lure a victim into clicking a crafted link. EPSS is 0.16% (5th percentile), indicating very low modeled probability of exploitation, and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. No proof-of-concept or working exploit reference is present in the supplied data - the only references are the Drupal security advisory (SA-contrib-2026-125) and the NVD/EUVD detail page. The vuln.today decision label is 'this_month', consistent with a patch-when-convenient cadence rather than act_now. The limited impact (C:L/I:L, A:N) reflects typical reflected XSS consequences - session/credential theft or limited action-on-behalf-of-victim within one browser session - not system compromise. There is no conflict among the signals; low EPSS, absence from KEV, and the moderate CVSS together suggest a genuine but non-urgent issue that should be remediated on a routine patch cycle.

An attacker crafts a malicious URL targeting the verification module's reflected input and sends it to an authenticated Drupal site visitor or administrator via phishing. When the victim clicks the link, attacker-controlled script executes in their browser session in the site's context, enabling session cookie theft or limited actions as that user. No public exploit code is identified in the available data, and successful attack requires the victim to interact with the crafted link (UI:R).