CVE-2025-48012

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficien...

Original description

The description as published by the source.

This module enables you to allow users to include a second authentication method in addition to password authentication.

The module doesn't sufficiently prevent the same TFA token within a 30 second window.

This vulnerability is mitigated by the fact that an attacker must obtain a valid username/password and second factor.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Packagist:https://packages.drupal.org/8 drupal/one_time_password

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0"}],"database_specific":{"constraint":"<1.3.0"}}]