Drupal Access code allows Brute Force Attempts
Impact
This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes based on the fact that access codes need to be unique and the system warns if the code of their choice is taken.
Source excerpt · OSVThis vulnerability is mitigated by the fact that an attacker must have a role with the "change own access code" permission.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.0.5Ecosystem versions | 2.0.5 |
Version evidence: OSV · GHSA-27mc-9399-r9mx
View original version evidence (0 explicit versions)
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.0.5Ecosystem versions | 2.0.5 |
Version evidence: OSV · DRUPAL-CONTRIB-2025-108
View original version evidence (0 explicit versions)
Original source description
This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes based on the fact that access codes need to be unique and the system warns if the code of their choice is taken.
This vulnerability is mitigated by the fact that an attacker must have a role with the "change own access code" permission.