The vulnerability in Drupal's Email Verification / SMS Verification / OTP Verification module allows an attacker to bypass the expected verification process by using an alternate path or channel, effectively authenticating as any user without completing the intended email, SMS, or OTP step. This flaw falls under CWE-288, compromising the integrity of the authentication system and enabling unauthorized access across the site.

Affected systems include any Drupal installation that has the Email Verification / SMS Verification / OTP Verification module enabled, specifically versions 0.0.0 through 2.4.0.

The disclosed CVSS score of 6.5 indicates a medium‑to‑high severity. The EPSS score of 0.00193% (less than 1%) indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. No large‑scale public exploitation is known, but the vulnerability remains exploitable when an attacker can send crafted requests to the module's verification endpoints. The attack vector is likely via direct API or web requests to the modify verification path, requiring no special privileges beyond reaching the endpoint.