Live › vulnerability › CVE-2026-107256
The Drupal Shield module does not restrict excessive authentication attempts, so an attacker can repeatedly guess passwords. Successful guessing would give access to the affected Drupal site's accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that have the Shield module installed at version 1.9.0 or earlier are affected, since Shield is the component that handles the authentication protection. Sites without Shield, or with a newer version, are not in the stated range. The sources do not say whether a non-default configuration is required.
No product ranges from the sources yet.
drush pm:list --filter=shield or in the Drupal admin Extend page) and see whether it is 1.9.0 or earlier.1.9.0 are affected; the sources do not state a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107256")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.