{"action":"Upgrade drupal/access_code to 2.0.5 or later.","affected":[{"fixed":"2.0.5","introduced":"0"}],"component":"drupal/access_code","cve_ids":["CVE-2025-10928"],"ecosystem":"Packagist","ecosystem_qualifier":"Packagist:https://packages.drupal.org/8","epss":0.00236,"exploited":false,"fixed_versions":["2.0.5"],"ghsa_id":"GHSA-27mc-9399-r9mx","id":"tcs_01M5MF83QT78ZPZ0M5AGZC3PS6","modified_at":"2026-09-10T03:45:05.996826441Z","published_at":"2025-09-24T17:27:20Z","references":["https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-108","https://www.drupal.org/sa-contrib-2025-108"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CONTRIB-2025-108","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-108"}],"summary":"This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes b"}