Skip to content
OpenAdvisories
Unscored DRUPAL-CONTRIB-2023-045

This module enables users to log in by email address with minimal configurations. Drupal core contains protection against brute force attac…

Published Sep 13, 2023 · Updated Sep 10, 2026 · Assigned by DRUPAL

Description

This module enables users to log in by email address with minimal configurations.

Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/mail_login < 2.8.0 2.8.0 DRUPAL-CONTRIB-2023-045

References