CVE-2026-107256
Received Received - Intake

Authentication Bypass in Drupal Shield via Brute Force

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Drupal.org

Description
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-107256
EUVD
EUVD-2026-113524

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Drupal Shield 0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Restriction of Excessive Authentication Attempts issue in Drupal Shield. It allows brute force attacks due to insufficient limits on login attempts. The flaw exists in versions 0.0.0 to 1.9.0 of Drupal Shield.

Impact Analysis

Attackers could exploit this to repeatedly attempt login credentials, potentially gaining unauthorized access to accounts. This may lead to data breaches, account takeovers, or unauthorized system control if credentials are guessed.

Mitigation Strategies

Update Drupal Shield to a version beyond 1.9.0 to address the improper restriction of excessive authentication attempts. Disable Shield temporarily if an update is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart