{"id":"CVE-2025-10928","aliases":["DRUPAL-CONTRIB-2025-108","EUVD-2025-36878","GHSA-27mc-9399-r9mx"],"status":"published","title":"Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00236,"percentile":0.14764,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-307"],"published":"2025-09-24T17:27:20Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"Packagist","package":"drupal/access_code","fixed_in":["2.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/access_code","fixed_in":["2.0.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/access_code","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/access_code","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/access_code","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}]}],"products":[{"vendor":"access_code_project","product":"access_code"},{"vendor":"drupal","product":"access code"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-108","tags":["Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10928","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-27mc-9399-r9mx"},{"url":"https://git.drupalcode.org/project/access_code","tags":["web"]},{"url":"https://www.drupal.org/project/access_code","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10928.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-10928","title":"Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.","status":"published","published":"2025-10-29T23:13:25.064Z","modified":"2025-10-30T13:07:25.555Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-36878","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.","status":"published","published":"2025-10-29T23:13:25Z","modified":"2025-10-30T13:07:25Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:36.236088Z"}],"ghsa":[{"id":"GHSA-27mc-9399-r9mx","title":"Drupal Access code allows Brute Force Attempts","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force. This issue affects Access code: from 0.0.0 before 2.0.5.","status":"published","published":"2025-10-30T00:31:03Z","modified":"2025-10-30T17:05:07Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-10928","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.","status":"published","published":"2025-10-30T00:15:34.06Z","modified":"2026-10-08T10:10:00.227Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:11:41.607433Z"}],"osv":[{"id":"CVE-2025-10928","title":"Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.","status":"published","published":"2025-10-29T23:13:25.064Z","modified":"2026-10-28T02:30:42.456739785Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"GHSA-27mc-9399-r9mx","title":"Drupal Access code allows Brute Force Attempts","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force. This issue affects Access code: from 0.0.0 before 2.0.5.","status":"published","published":"2025-10-30T00:31:03Z","modified":"2025-12-10T23:41:09.768849Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"DRUPAL-CONTRIB-2025-108","description":"This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes based on the fact that access codes need to be unique and the system warns if the code of their choice is taken.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the \"change own access code\" permission.","status":"published","published":"2025-09-24T17:27:20Z","modified":"2026-09-10T03:45:05.996826441Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}