EUVD-2026-43091
GHSA-q4vw-q8jq-2jg7
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
PR:H confirmed by need for high-privilege account; AC:H reflects non-trivial exploitation conditions; no availability impact aligns with CWE-307 scope.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
2DescriptionCVE.org
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
AnalysisAI
Improper restriction of excessive authentication attempts (CWE-307) in the Drupal contributed module 'Brute force attack protection' allows a network-based attacker with high privileges to bypass the module's core protective controls, resulting in high confidentiality and integrity impact. All released versions of the module (*.*) are affected, as confirmed by Drupal security advisory SA-contrib-2026-047. No public exploit code has been identified and EPSS places this at the 5th percentile, indicating minimal observed exploitation activity at time of analysis.
Technical ContextAI
The affected software is the Drupal contributed module 'Brute force attack protection' (CPE: cpe:2.3:a:drupal:brute_force_attack_protection:*:*:*:*:*:*:*:*), which is designed to limit excessive authentication attempts on Drupal CMS installations. CWE-307 (Improper Restriction of Excessive Authentication Attempts) is the root cause class - the module itself fails to properly enforce the very controls it is intended to provide. This is a self-referential flaw: the protection layer can be circumvented or misconfigured in a way that undermines authentication throttling. The tags 'Information Disclosure' and 'Brute Force Attack Protection' suggest that the bypass may expose credential enumeration vectors or leak rate-limiting state information. The CVSS vector AV:N/AC:H/PR:H indicates the flaw is reachable over the network but requires high complexity and high-privilege credentials to exploit.
RemediationAI
Consult the Drupal security advisory SA-contrib-2026-047 at https://www.drupal.org/sa-contrib-2026-047 for the specific patched module version and update instructions, as an exact fix version is not independently confirmed from the available input data. The advisory is the authoritative source for upgrade paths. As a compensating control while patching, administrators should consider supplementing or replacing the module with server-level rate limiting (e.g., fail2ban, mod_evasive, or WAF rules targeting the Drupal login endpoint) - these controls operate outside Drupal's application layer and cannot be bypassed by a module-level flaw. Additionally, restricting high-privilege Drupal accounts to trusted IP ranges reduces exposure given the PR:H exploitation requirement. Note that disabling the module entirely removes brute force protection; pair any removal with an alternative control before doing so.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today