CVE-2025-3129 Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028
Attackers can bypass authentication restrictions to perform brute force attacks on the Drupal Access code module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-3129?
CVE-2025-3129 is a medium-severity authentication bypass vulnerability in Drupal Access code, published on 2 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.
Weakness: CWE-307
Which versions are affected by CVE-2025-3129?
It affects 1 product.
Linux distribution packages (1)
drupal/access_code Packagist:https://packages.drupal.org/8 | All versions | 2.0.4 |
Products include Access Code Project Access Code.
How do I fix CVE-2025-3129?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-3129 being exploited?
There is no known exploitation of CVE-2025-3129 in the wild and no public exploit code.
Other vulnerabilities in Drupal Access code
Sources
Also known as CLSA-2026-1788969961, DRUPAL-CONTRIB-2025-028, GHSA-9qmr-4gv6-xmf3.