Drupal OTP Verification XSS and Auth Bypass

Authentication bypass in the Drupal contrib module Email Verification / SMS Verification / OTP Verification (versions 0.0.0 through below 2.4.0) allows remote, unauthenticated attackers to skip the verification step the module is meant to enforce, with CVSS 3.1 scored 6.5 (AV:N/AC:L/PR:N/UI:N, C:L/I:L/A:N). Only Drupal sites that actually install and enable this contrib module - and rely on it as an access or action gate - are exposed, and the realistic impact is bounded to bypassing that check rather than full site compromise. No public exploit has been identified at time of analysis, CISA KEV does not list the issue, SSVC rates exploitation as none with partial technical impact, and EPSS is 0.19% (8th percentile), so the available decision signals converge on a this-month, non-emergency remediation priority. A vendor patch is available.

Reflected cross-site scripting (CVSS 5.4) affects the Drupal contrib module 'Email Verification / SMS Verification / OTP Verification' in all versions from 0.0.0 through 2.4.0, allowing an attacker who convinces a victim to open a crafted URL to execute script in that victim's browser session on the Drupal site. No authentication is required of the attacker, but exploitation depends on victim interaction (UI:R) and the specific reflecting parameter is not described in the available sources. No public exploit code or active exploitation is known, EPSS is low at 0.16% (5th percentile), and the vendor has released a patch in version 2.4.0.