AIKIDO-2025-10453
drupal/mail_login is vulnerable to Improper Restriction of Excessive Authentication Attempts
98
Critical Risk
This Affects:
drupal/mail_loginTL;DR
Affected versions of this package are vulnerable to brute-force attacks due to incomplete protection mechanisms on the login form. Although the module implements some safeguards, they can be bypassed by an attacker, potentially allowing repeated login attempts and unauthorized account access.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
drupal/mail_login is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 3.0.0 - 3.1.0 and 4.0.0 - 4.0.3.
How to fix this
Upgrade the drupal/mail_login library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant