| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/one_time_password | < 1.3.0 | 1.3.0 |
| one time password | ≥ 8.x-1.0, < 8.x-1.3 | 8.x-1.3 |
This module enables you to allow users to include a second authentication method in addition to password authentication.
The module doesn't sufficiently prevent the same TFA token within a 30 second window.
This vulnerability is mitigated by the fact that an attacker must obtain a valid username/password and second factor.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free