—
DRUPAL-CONTRIB-2025-063
Details
This module enables you to allow users to include a second authentication method in addition to password authentication.
The module doesn't sufficiently prevent the same TFA token within a 30 second window.
This vulnerability is mitigated by the fact that an attacker must obtain a valid username/password and second factor.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/one_time_password
Introduced in:
0Fixed in: 1.3.0Upgrade drupal/one_time_password to 1.3.0 or newer (ecosystem packagist:https://packages.drupal.org/8).