DRUPAL-CONTRIB-2026-305: Composer/drupal/reset_password_email_otp vulnerability

Q: Who is exposed to this issue?

Deployments using the reset_password_email_otp Drupal module are affected if a password reset can be performed for a blocked user. The issue concerns blocked accounts rather than ordinary active-account password resets.

Q: What must happen for an attacker to use a reset password for a blocked account?

An attacker would need to reset the blocked user's password through the module's one-time passcode flow. They still cannot use the new password unless someone with appropriate permissions unblocks that user account.

Q: What can be done if the module cannot be updated immediately?

Review and tightly control permissions to unblock user accounts, since unblocking is required before a password reset for a blocked user can be used. Monitor unblock actions involving accounts that may have undergone password-reset attempts.

Published Nov 4, 2026

Updated

This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links.

The module doesn't sufficiently validate resetting passwords for blocked users.

This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password.

Affected Software

1 affected componentFixes available

composer/drupal/reset_password_email_otp<1.0.5

1.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/reset_password_email_otp to a version that resolves this vulnerability.
Fixed in 1.0.5

Event History

Nov 4, 2026

Advisory Published

via OSV·05:34 PM

Data Sourced

via OSV·05:34 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Deployments using the reset_password_email_otp Drupal module are affected if a password reset can be performed for a blocked user. The issue concerns blocked accounts rather than ordinary active-account password resets.

What must happen for an attacker to use a reset password for a blocked account?

An attacker would need to reset the blocked user's password through the module's one-time passcode flow. They still cannot use the new password unless someone with appropriate permissions unblocks that user account.

What can be done if the module cannot be updated immediately?

Review and tightly control permissions to unblock user accounts, since unblocking is required before a password reset for a blocked user can be used. Monitor unblock actions involving accounts that may have undergone password-reset attempts.

DRUPAL-CONTRIB-2026-305: Composer/drupal/reset_password_email_otp vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must happen for an attacker to use a reset password for a blocked account?

What can be done if the module cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must happen for an attacker to use a reset password for a blocked account?

What can be done if the module cannot be updated immediately?