Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2025-10928: Drupal Access code permits unlimited password guesses
CVE-2025-10928 · published 1 year ago
Summary
The Access code module for Drupal (versions before 2.0.5) does not limit how many times someone can try to log in. This lets attackers repeatedly guess passwords until they succeed, potentially gaining unauthorized access. Install the updated version (2.0.5 or later) and consider adding login‑attempt limits or multi‑factor authentication.
What to do
- Update drupal access_code to version 2.0.5.
- Update access_code_project access_code to version 2.0.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | drupal | access_code |
< 2.0.5 Fix: upgrade to 2.0.5
|
| – | access_code_project | access_code |
< 2.0.5 cpe:2.3:a:access_code_project:access_code:*:*:*:*:*:drupal:*:* |
Original advisory text
Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.
References
- https://github.com/advisories/GHSA-27mc-9399-r9mx
- https://www.drupal.org/sa-contrib-2025-108 URL
- https://www.drupal.org/project/access_code URL
- https://git.drupalcode.org/project/access_code URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10928... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-10928 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published29 Oct 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta