CVE-2026-122074: Composer/drupal/reset_password_email_otp vulnerability
This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links.
The module doesn't sufficiently validate resetting passwords for blocked users.
This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/reset_password_email_otpto a version that resolves this vulnerability.Fixed in 1.0.5
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites using composer/drupal/reset_password_email_otp are affected when password resets can be performed for blocked users. Exploitation also depends on a user with appropriate permissions unblocking the affected account.
What must happen for an attacker to use a password reset on a blocked account?
The attacker must reset the blocked user's password through the module's one-time-passcode email or SMS flow. A user with appropriate permissions must then unblock that account before the attacker can use the new password.
What can be done if patching is not immediately possible?
Prevent or tightly control password resets for blocked users and review the permissions of users who can unblock accounts. The stated mitigation is that unblocking requires appropriate permissions.