CVE-2026-84923— Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124
Quick assessment
Affected
Drupal Email Verification / SMS Verification / OTP Verification
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Drupal 的邮件验证、短信验证或一次性密码（OTP）验证模块中存在通过备用路径或通道绕过身份验证的漏洞，可导致身份验证被绕过。该问题影响版本范围：从 0.0.0 到 2.4.0。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84923
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124
Source: CVE Program / CVE List V5
Vulnerability Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Drupal | Email Verification / SMS Verification / OTP Verification | 0.0.0 ~ 2.4.0 | - |
|
II. Public POCs for CVE-2026-84923
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84923
请登录查看更多情报信息。
Other References for CVE-2026-84923 (1)
Same Patch Batch · Drupal · 2026-10-22 · 72 CVEs total
| CVE-2026-96369 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 | |
| CVE-2026-96392 | AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-18 | |
| CVE-2026-96388 | Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026- | |
| CVE-2026-96398 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 | |
| CVE-2026-96357 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 | |
| CVE-2026-96364 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 | |
| CVE-2026-96365 | Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 | |
| CVE-2026-96366 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 | |
| CVE-2026-96373 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 | |
| CVE-2026-96372 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 | |
| CVE-2026-96356 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 | |
| CVE-2026-96371 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 | |
| CVE-2026-96370 | Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-20 | |
| CVE-2026-96368 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 | |
| CVE-2026-96367 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 | |
| CVE-2026-96363 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161 | |
| CVE-2026-96359 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 | |
| CVE-2026-96362 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 | |
| CVE-2026-96358 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 | |
| CVE-2026-96361 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 |
Showing top 20 of 72 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Drupal
-
CVE-2026-84910
Advanced Search - Moderately critical - Access bypass - SA-C -
CVE-2026-84911
AI (Artificial Intelligence) - Moderately critical - Cross s -
CVE-2026-84912
AI (Artificial Intelligence) - Moderately critical - Access -
CVE-2026-84913
AI translate - Moderately critical - Access Bypass - SA-CONT -
CVE-2026-84914
Calculate Working Days - Critical - Access bypass - SA-CONTR
Same weakness: CWE-288
-
CVE-2026-114732
Roundcube 1.6.20/1.7.5 多主机认证绕过漏洞 -
CVE-2026-114635
Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTT -
CVE-2026-96385
REST & JSON API Authentication for Drupal - Moderately criti -
CVE-2026-96387
Stop administrator login - Moderately critical - Access bypa -
CVE-2026-111438
check_hba_replication 认证与访问控制绕过
V. Comments for CVE-2026-84923
No comments yet