CVE-2025-48010
One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
- Record
CVE-2025-48010- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2025-16013
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
- Record
EUVD-2025-16013- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fj3h-m99f-v4q3
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time...
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
- Record
GHSA-fj3h-m99f-v4q3- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
- Record
CVE-2025-48010- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2025-061 No score
This module enables you to allow users to include a second authentication method in addition to password authentication.
The module doesn't sufficiently prevent one time login links from bypassing TFA.
This vulnerability is mitigated by the fact that an attacker must have access to an email account attached to a user or a valid one time password link for a user.
- Record
DRUPAL-CONTRIB-2025-061- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/one_time_passwordPackagist:https://packages.drupal.org/8 |
before 1.3.0 | 1.3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-48010 is a medium vulnerability (CVSS 4.8) in Drupal One Time Password, published May 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in drupal/one_time_password 1.3.0.