Email Login OTP Authentication Bypass in Drupal

Publication date: 2026-08-25

Last updated on: 2026-08-28

Assigner: Drupal.org

Description

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-16642

EUVD

EUVD-2026-66205

Affected Vendors & Products

Vendor	Product	Version / Range
drupal	email_login_otp	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Drupal Email Login OTP module, which allows users to log in via one-time passwords sent to their email. The issue impacts all versions of this module. The exact nature of the vulnerability is not specified in the provided context.

Impact Analysis

Without more details, it is unclear how this vulnerability could be exploited. Potential impacts may include unauthorized access to user accounts if the OTP system is compromised, leading to data breaches or account takeovers.

Hi! I’m here to help you understand CVE-2026-16642. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70