{"id":"CVE-2025-7393","aliases":["DRUPAL-CONTRIB-2025-088","EUVD-2025-22130","GHSA-jf2c-8v4p-mgg2"],"status":"published","title":"Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00525,"percentile":0.44793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-307"],"published":"2025-07-09T16:37:40Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/mail_login","fixed_in":["3.2.0","4.2.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/mail_login","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.2.0"}]}]}],"products":[{"vendor":"drupal","product":"mail login"},{"vendor":"mqanneh","product":"mail_login"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-088","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7393","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jf2c-8v4p-mgg2"},{"url":"https://git.drupalcode.org/project/mail_login","tags":["web"]},{"url":"https://www.drupal.org/project/mail_login","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7393.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-7393","title":"Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.","status":"published","published":"2025-07-21T16:35:45.527Z","modified":"2025-07-22T14:07:11.356Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:32:51.880027Z"}],"euvd":[{"id":"EUVD-2025-22130","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.","status":"published","published":"2025-07-21T16:35:45Z","modified":"2025-07-22T14:07:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:05.744165Z"}],"ghsa":[{"id":"GHSA-jf2c-8v4p-mgg2","title":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login...","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.","status":"published","published":"2025-07-21T18:32:18Z","modified":"2025-07-22T15:33:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:03:05.693325Z"}],"nvd":[{"id":"CVE-2025-7393","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.","status":"published","published":"2025-07-21T17:15:37.64Z","modified":"2026-06-17T10:04:50.067Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:11:19.382856Z"}],"osv":[{"id":"CVE-2025-7393","title":"Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.","status":"published","published":"2025-07-21T16:35:45.527Z","modified":"2026-10-28T02:30:59.125400877Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"DRUPAL-CONTRIB-2025-088","description":"This module enables users to login by email address with the minimal configurations.\n\nThe module included some protection against brute force attacks on the login form, however they were incomplete. An attacker could bypass the brute force protection allowing them to potentially gain access to an account.","status":"published","published":"2025-07-09T16:37:40Z","modified":"2026-09-10T03:45:56.85037794Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}