Brute Force Attack Protection
Monthly
Improper restriction of excessive authentication attempts (CWE-307) in the Drupal contributed module 'Brute force attack protection' allows a network-based attacker with high privileges to bypass the module's core protective controls, resulting in high confidentiality and integrity impact. All released versions of the module (*.*) are affected, as confirmed by Drupal security advisory SA-contrib-2026-047. No public exploit code has been identified and EPSS places this at the 5th percentile, indicating minimal observed exploitation activity at time of analysis.
Improper restriction of excessive authentication attempts (CWE-307) in the Drupal contributed module 'Brute force attack protection' allows a network-based attacker with high privileges to bypass the module's core protective controls, resulting in high confidentiality and integrity impact. All released versions of the module (*.*) are affected, as confirmed by Drupal security advisory SA-contrib-2026-047. No public exploit code has been identified and EPSS places this at the 5th percentile, indicating minimal observed exploitation activity at time of analysis.