SA-CONTRIB-2026-125: XSS

Q: Does an attacker need an account to exploit this issue?

No. The vulnerability is unauthenticated, so exploitation does not require the attacker to log in or have a registered account.

Published Sep 2, 2026

Updated

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting (XSS) vulnerability.

Credit

Drew Webber (mcdruid)(the Drupal Security Team)

Affected Software

1 affected componentFixes available

drupal/otp_verification<8.x-2.4

8.x-2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/otp_verification to a version that resolves this vulnerability.
Fixed in 8.x-2.4

Event History

Sep 2, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-84924

Frequently Asked Questions

Does an attacker need an account to exploit this issue?