SA-CONTRIB-2026-305: Critical severity composer/drupal/reset_password_email_otp vulnerability

Q: What must happen for an attacker to use a password reset on a blocked account?

A user with appropriate permissions must first unblock the affected account. The issue is mitigated because the attacker cannot use the new password while the account remains blocked.

Q: Which password reset workflows are relevant to this issue?

The affected module supports one-time-passcode password resets delivered by email or SMS rather than password reset links. The insufficient validation applies when resetting passwords for blocked users.

Published Nov 4, 2026

Updated

This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The module doesn't sufficiently validate resetting passwords for blocked users. This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the affected user for the attacker to use the new password.

Credit

Scott Euser (scott_euser)

Affected Software

1 affected componentFixes available

composer/drupal/reset_password_email_otp<1.0.5

1.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/reset_password_email_otp to a version that resolves this vulnerability.
Fixed in 1.0.5

Event History

Nov 4, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122074

Frequently Asked Questions

What must happen for an attacker to use a password reset on a blocked account?

A user with appropriate permissions must first unblock the affected account. The issue is mitigated because the attacker cannot use the new password while the account remains blocked.

Which password reset workflows are relevant to this issue?

The affected module supports one-time-passcode password resets delivered by email or SMS rather than password reset links. The insufficient validation applies when resetting passwords for blocked users.

SA-CONTRIB-2026-305: Critical severity composer/drupal/reset_password_email_otp vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must happen for an attacker to use a password reset on a blocked account?

Which password reset workflows are relevant to this issue?

Company

Resources

Contact

Frequently Asked Questions

What must happen for an attacker to use a password reset on a blocked account?

Which password reset workflows are relevant to this issue?