CVE-2025-10928: 
PHP vulnerability analysis and mitigation

A vulnerability identified as CVE-2025-10928 was discovered in Drupal Access code, affecting versions from 0.0.0 to before 2.0.5. The vulnerability is classified as an Improper Restriction of Excessive Authentication Attempts issue, which could potentially allow attackers to perform brute force attacks (Drupal Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 6.3 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, and doesn't require user interaction. The impact affects confidentiality, integrity, and availability, all at a low level (AttackerKB).

The vulnerability could allow attackers to perform brute force attacks against authentication mechanisms, potentially leading to unauthorized access to user accounts. The CVSS scoring indicates low-level impacts on confidentiality, integrity, and availability of the affected system (AttackerKB).

Users are advised to upgrade to Access code version 2.0.5 or later to address this vulnerability (Drupal Advisory).