CVE-2025-9551
Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
- Record
CVE-2025-9551- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-307
- Updated
- 2026-11-02
EUVDEUVD-2025-33789
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
- Record
EUVD-2025-33789- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c25q-57mr-rv37
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages...
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0.
- Record
GHSA-c25q-57mr-rv37- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-307
- Updated
- 2026-11-02
NVD
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
- Record
CVE-2025-9551- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-307
- Updated
- 2026-11-02
OSVCLSA-2026-1789633295 No score
TuxCare security update for drupal/protected_pages (1 CVE)
TuxCare rebuilt drupal/protected_pages to address 1 CVE. Fixed in 7.2.4-p1+tuxcare.
- Record
CLSA-2026-1789633295- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2025-101 No score
This module enables you to protect individual pages with a password.
The module doesn't limit the number of password attempts, making it vulnerable to brute force attacks.
This vulnerability is mitigated by the fact that an attacker must know the protected page's URL.
CVSS risk score (experimental) 6.3 / Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Record
DRUPAL-CONTRIB-2025-101- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/protected_pagesTuxCare:Packagist |
7.2.4 up to 7.2.4-p1+tuxcare | 7.2.4-p1+tuxcare |
drupal/protected_pagesPackagist:https://packages.drupal.org/8 |
before 1.8.0 | 1.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-9551 is a medium vulnerability (CVSS 6.5) in Drupal Protected Pages, published August 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in drupal/protected_pages 7.2.4-p1+tuxcare.