CVE-2025-48010 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061
Attackers can bypass authentication in the Drupal One Time Password module, allowing unauthorized access to protected functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48010?
CVE-2025-48010 is a medium-severity authentication bypass vulnerability in Drupal One Time Password, published on 21 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
Weakness: CWE-288
Which versions are affected by CVE-2025-48010?
It affects 1 product.
Linux distribution packages (1)
drupal/one_time_password Packagist:https://packages.drupal.org/8 | All versions | 1.3.0 |
Products include One Time Password Project One Time Password.
How do I fix CVE-2025-48010?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-48010 being exploited?
There is no known exploitation of CVE-2025-48010 in the wild and no public exploit code.
Other vulnerabilities in Drupal One Time Password
Sources
Also known as DRUPAL-CONTRIB-2025-061, GHSA-fj3h-m99f-v4q3.