Drupal Access Code CVE-2025-10928

Exploitation requires reaching the Drupal 'Access code' module's authentication/code-entry interface on an instance running a version before 2.0.5; the module performs no throttling, lockout, or delay on repeated attempts, enabling automated guessing. Effectiveness is LIMITED by the entropy of the configured access codes (long/random codes resist guessing even without rate-limiting) and by the vendor-assigned PR:L, which implies some prior privilege or session may be needed to reach the form - though the description does not confirm an authentication gate. Impact is confined to the low-sensitivity access the code protects (C:L/I:L/A:L), not full site compromise.

This is a genuine but low-priority weakness. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L = 6.3 Medium) reflects an automatable network-based attack, but every impact metric is only Low, consistent with CWE-307 (missing brute-force throttling) rather than a direct code-execution or full-takeover flaw. EPSS is low at 0.24% (13th percentile), there is no CISA KEV listing, and no public exploit code was identified, so all exploitation signals point to low near-term risk. The signals are internally consistent - nothing here suggests an under-rated threat. One caveat: the vendor rated PR:L (authenticated), yet brute-forcing an access-code gate is typically reachable pre-authentication; the privilege prerequisite should be verified against the actual module deployment. Net assessment: real but modest issue, patch-when-convenient, not an emergency.

A remote attacker repeatedly submits guesses to the Drupal 'Access code' module's entry form, which lacks any attempt-limiting or lockout, until a valid code is found and gated content or functionality is unlocked. Because the attack is network-based with low complexity (AV:N/AC:L), it is trivially scriptable against weak or short codes. No public proof-of-concept exploit has been identified at the time of analysis.