Drupal OTP Verification EUVD-2026-107875

The affected Drupal site must have the Email Verification / SMS Verification / OTP Verification contrib module installed and enabled at a version in the range 0.0.0 through below 2.4.0, and must rely on that module to gate access or actions. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration is indicated as a prerequisite - exploitation is remote and unauthenticated. The limiting factors are therefore scope rather than access: only sites that deploy this specific contrib module and depend on it as a verification control are exposed, and the realistic impact is bounded (CVSS C:L/I:L/A:N) to bypassing the verification step rather than full system compromise. The exact trigger (how the alternate path is reached) is not described in the available sources.

This is a moderate-severity authentication bypass (CVSS 6.5) in a Drupal contrib module, and the multiple decision signals converge on a non-urgent priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, but impact is capped at C:L/I:L/A:N (partial, not total compromise), consistent with CWE-288 (authentication bypass via alternate path). The corroborating signals all point the same way rather than conflicting: EPSS is low at 0.19% (8th percentile), SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, and the vuln.today decision label is 'this_month' (not act_now or emergency). There is no CISA KEV listing and no public exploit reference in the input. The consistency across EPSS, SSVC, and the absence of KEV/POC indicates this is a genuine-but-not-emergency issue: real because exploitation is unauthenticated and low-complexity against a security control (identity verification), but not a widespread active threat. The main caveat is mechanism: the description names the weakness class (alternate path/channel) but not the concrete trigger, so the practical ease of bypass cannot be fully verified from the available sources.

An unauthenticated attacker interacts with a Drupal site running the Email/SMS/OTP Verification module and reaches a protected account or action through an alternate path that skips the verification step the module is meant to enforce, obtaining access or completing an action without passing OTP/email/SMS validation. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to the application with no credentials or user interaction. No public exploit code is identified in the available data, and the exact trigger is not described in the sources.