Description
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | Protected Pages | 0.0.0 – < 1.8.0, 7.x-1.0 – < 7.x-2.5 | 1.8.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/protected_pages | < 1.8.0 | 1.8.0 | DRUPAL-CONTRIB-2025-101 |
Advisories 1
- WID-SEC-2025-1918 Drupal Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
References
- https://www.drupal.org/sa-contrib-2025-101 vendor-advisory
- https://docs.herodevs.com/drupal/release-notes/protected-pages third-party-advisory
- https://d7es.tag1.com/security-advisories/protected-pages-moderately-critical-access-bypass-sa-contrib-2025-101 third-party-advisory