CVE-2025-9551: Drupal Protected Pages Auth Bypass Flaw

CVE-2025-9551 Overview

CVE-2025-9551 affects the Drupal Protected Pages module, which allows site administrators to password-protect individual pages. The module fails to restrict excessive authentication attempts, enabling attackers to brute force page passwords over the network. The flaw is tracked under CWE-307: Improper Restriction of Excessive Authentication Attempts.

The issue affects Protected Pages versions from 0.0.0 before 1.8.0, and from 7.X-1.0 before 7.X-2.5. Because no rate limiting or lockout protects the authentication endpoint, unauthenticated remote attackers can automate password guessing against protected content.

Critical Impact
Unauthenticated remote attackers can perform automated brute force attacks against password-protected Drupal pages, exposing restricted content without user interaction.

Affected Products

Drupal Protected Pages module versions 0.0.0 through 1.7.x (fixed in 1.8.0)
Drupal Protected Pages module versions 7.X-1.0 through 7.X-2.4 (fixed in 7.X-2.5)
Drupal sites using the Protected Pages contributed module for page-level access control

Discovery Timeline

2025-10-10 - CVE-2025-9551 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9551

Vulnerability Analysis

The Protected Pages module provides a per-page password gate. When a user requests a protected URL, the module presents a password form and validates the submission against a stored credential. The vulnerable implementations accept an unlimited number of submissions from the same client, session, or IP address.

This absence of throttling turns the password form into a brute force oracle. An attacker script can iterate through common password dictionaries or targeted wordlists at request-per-second rates. Successful authentication grants access to the underlying page content, bypassing the intended access restriction.

The vulnerability is classified as an access bypass condition by the upstream vendor. Attack complexity is low, no privileges are required, and no user interaction is needed to attempt exploitation. The EPSS probability of exploitation is approximately 0.351%.

Root Cause

The root cause is the absence of a lockout, throttling, or CAPTCHA control in the password verification path of the Protected Pages module. Neither failed attempt counters nor time-based backoff logic gates repeated submissions against the same protected page.

Attack Vector

Exploitation is performed over the network against the public password submission endpoint of a Drupal site that uses Protected Pages. An attacker automates HTTP POST requests carrying candidate passwords for a target protected URL. Because attempts are not rate-limited, the practical time to compromise is bounded only by password entropy and network bandwidth.

No verified public proof-of-concept is currently available. The vulnerability mechanism is documented in the Drupal Security Advisory SA-CONTRIB-2025-101 and the Tag1 Security Advisory.

Detection Methods for CVE-2025-9551

Indicators of Compromise

High volumes of HTTP POST requests to Protected Pages authentication endpoints (typically paths under /protected-page or module-defined form routes) from a single source or coordinated set of sources
Repeated failed password submissions logged by Drupal's watchdog or webserver access logs against the same protected URL
Sequential or dictionary-ordered password values observed in request bodies
Anomalous access to protected content following short bursts of authentication traffic

Detection Strategies

Baseline normal submission rates for Protected Pages forms and alert when a source exceeds the baseline by an order of magnitude
Correlate 4xx responses from protected page URLs with subsequent 200 or 302 responses from the same client to identify successful brute force outcomes
Deploy web application firewall (WAF) rules that count password form submissions per IP, per session, and per target URL

Monitoring Recommendations

Enable verbose logging on the Drupal Protected Pages module and forward logs to a centralized SIEM for retention and correlation
Monitor for user-agent strings associated with automation tools such as curl, python-requests, and headless browsers hitting protected URLs
Track geolocation and ASN diversity of clients submitting to protected page forms to identify distributed brute force campaigns

How to Mitigate CVE-2025-9551

Immediate Actions Required

Upgrade the Protected Pages module to version 1.8.0 or later for Drupal 8+ sites
Upgrade to version 7.X-2.5 or later for Drupal 7 sites, or migrate to a supported release channel through HeroDevs Release Notes if running end-of-life Drupal 7
Rotate all passwords configured for protected pages after patching, since prior values may have been enumerated

Patch Information

The maintainers released fixed versions 1.8.0 and 7.X-2.5 addressing the missing rate limiting. Refer to the Drupal Security Advisory SA-CONTRIB-2025-101 for the authoritative patch reference and version guidance.

Workarounds

Place protected pages behind an additional authentication layer, such as HTTP basic authentication at the webserver or reverse proxy
Configure WAF or reverse proxy rules to rate-limit POST requests to Protected Pages form endpoints per IP and per session
Restrict access to protected page URLs by source IP allowlist where the audience is known
Enforce high-entropy passwords for every protected page to raise the cost of brute force until patching is complete

bash

# Example nginx rate limit for Protected Pages form submissions
limit_req_zone $binary_remote_addr zone=pp_login:10m rate=5r/m;

location ~ ^/protected-page {
    limit_req zone=pp_login burst=5 nodelay;
    proxy_pass http://drupal_backend;
}