CVE-2025-48012
EPSS 0.22%
Description
This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent the same TFA token within a 30 second window. This vulnerability is mitigated by the fact that an attacker must obtain a valid username/password and second factor.
How to fix CVE-2025-48012
To remediate CVE-2025-48012, upgrade the affected package to a fixed version below.
- Packagist/drupal/one_time_password—upgrade to 1.3.0 or later
Is CVE-2025-48012 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.3.0