CVE-2025-10928
Medium · 6.3Drupal Access code allows Brute Force Attempts
CVSS
6.3
EPSS
0.2%
Published
Oct 30, 2025
CISA due date
—
The record
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force. This issue affects Access code: from 0.0.0 before 2.0.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | drupal/access_code | 0 | 2.0.5 |
| Packagist:https://packages.drupal.org/8 | drupal/access_code | 0 | 2.0.5 |
Related vulnerabilities
- CVE-2026-89174 Smart Video Intercom System developed by Kingdom Communication Associated has a Missing… CWE-307
- CVE-2026-88770 A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and… CWE-307
- CVE-2026-78490 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-307
- CVE-2026-86729 WWBN AVideo through commit e01e41ecc (no patched version available) exposes… CWE-307
- CVE-2026-20514 In Audio HAL, there is a possible information disclosure due to a missing permission… CWE-307
- CVE-2026-20512 In Audio HAL, there is a possible escalation of privilege due to improper input… CWE-307
- CVE-2026-86186 AVideo API fails to enforce rate limits when clients send a bot User-Agent header… CWE-307
- CVE-2026-85237 A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed… CWE-307