CVE-2025-10928
2 advisories.
Packagist/drupal/access_code CVE-2025-10928: medium 6.3, EPSS 0.24%
Drupal Access code allows Brute Force Attempts
Action: Upgrade drupal/access_code to 2.0.5 or later.
composer require drupal/access_code:2.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.5 | - |
Fixed versions
| 2.0.5 |
Sources
- osv: GHSA-27mc-9399-r9mx
- https://nvd.nist.gov/vuln/detail/CVE-2025-10928
- https://www.drupal.org/sa-contrib-2025-108
CVE-2025-10928 · published · modified · JSON
Packagist/drupal/access_code CVE-2025-10928: unknown, EPSS 0.24%
This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes b
Action: Upgrade drupal/access_code to 2.0.5 or later.
composer require drupal/access_code:2.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.5 | - |
Fixed versions
| 2.0.5 |
Sources
CVE-2025-10928 · published · modified · JSON