CVE-2025-10928 Overview
CVE-2025-10928 is an Improper Restriction of Excessive Authentication Attempts vulnerability [CWE-307] affecting the Drupal Access Code contributed module. The flaw exists in all versions from 0.0.0 before 2.0.5 and enables brute-force attacks against the access code authentication mechanism. An attacker with low-privileged network access can repeatedly submit access code guesses without being rate-limited or locked out. The Drupal Security Team published advisory SA-CONTRIB-2025-108 documenting the issue.
Critical Impact
Attackers can conduct unrestricted brute-force attempts against the Access Code module, potentially guessing valid codes to gain unauthorized access to protected Drupal content.
Affected Products
- Drupal Access Code module versions 0.0.0 through 2.0.4
- Drupal sites using access_code_project:access_code for content gating
- Fixed in Access Code module version 2.0.5
Discovery Timeline
- 2025-10-30 - CVE-2025-10928 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10928
Vulnerability Analysis
The Access Code module for Drupal provides an authentication mechanism where users enter a shared code to access restricted content. The module fails to enforce limits on the number of failed authentication attempts from a single source. Attackers can iterate through the access code keyspace by submitting successive HTTP requests until a valid code is discovered.
Because the authentication surface is exposed over the network and requires only a low-privileged (or authenticated) account, automated tooling can drive thousands of attempts against the endpoint. The confidentiality, integrity, and availability impact is limited to content protected by the module rather than the full Drupal site.
Root Cause
The root cause is missing rate-limiting logic and the absence of account or IP lockout behavior on failed access code submissions. The module accepts and validates each submission independently without tracking prior failed attempts. This aligns with the CWE-307 classification of improper restriction of excessive authentication attempts.
Attack Vector
Exploitation requires network access to a Drupal site that has the vulnerable Access Code module installed and enabled. An attacker submits a scripted loop of HTTP POST requests to the access code entry form, iterating through candidate codes. With no throttling, an attacker with sufficient bandwidth and a small keyspace can enumerate valid codes in a reasonable timeframe. See the Drupal Security Advisory for the vendor's technical details.
Detection Methods for CVE-2025-10928
Indicators of Compromise
- High volume of HTTP POST requests to Access Code submission endpoints from a single IP or narrow IP range
- Repeated 4xx responses (validation failures) followed by a successful 2xx or 3xx redirect indicating a guessed code
- Anomalous access to gated content from user sessions that did not previously interact with those nodes
- User agents consistent with automation tooling (curl, python-requests, Hydra) hitting access code forms
Detection Strategies
- Enable Drupal dblog or syslog module logging on access code submission events and alert on repeated failures per source
- Deploy a Web Application Firewall (WAF) rule that counts requests to the access code endpoint and flags thresholds beyond normal user behavior
- Correlate web server access logs with authentication events to identify brute-force patterns against gated URLs
Monitoring Recommendations
- Track failed access code submissions per source IP over 1-minute and 10-minute windows
- Baseline legitimate traffic to access-code-protected paths and alert on statistical deviation
- Forward Drupal watchdog logs and web server logs to a centralized SIEM for correlation and long-term retention
How to Mitigate CVE-2025-10928
Immediate Actions Required
- Upgrade the Drupal Access Code module to version 2.0.5 or later on all affected sites
- Audit web server and Drupal logs for prior brute-force activity against access code endpoints
- Rotate all active access codes after upgrading, in case codes were previously exposed through guessing
- Restrict access to access-code-protected pages behind a WAF or network ACL where feasible
Patch Information
The vendor released Access Code module version 2.0.5, which addresses the missing rate-limiting behavior. Site administrators should update via composer update drupal/access_code or through the Drupal Update Manager, then run database updates. Refer to the Drupal Security Advisory SA-CONTRIB-2025-108 for release details.
Workarounds
- Place the access code endpoint behind a WAF rule that enforces per-IP request rate limits
- Use a reverse proxy (nginx limit_req, Cloudflare rate limiting) to throttle POST requests to the module endpoint
- Temporarily disable the Access Code module until the update to 2.0.5 can be deployed
- Increase access code length and entropy to raise the cost of brute-force attempts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
