—
DRUPAL-CONTRIB-2025-108
Details
This module enables users to sign in with an access code instead of entering user names and passwords. When users are allowed to pick their own access codes, they can guess other users' access codes based on the fact that access codes need to be unique and the system warns if the code of their choice is taken.
This vulnerability is mitigated by the fact that an attacker must have a role with the "change own access code" permission.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/access_code
Introduced in:
0Fixed in: 2.0.5Upgrade drupal/access_code to 2.0.5 or newer (ecosystem packagist:https://packages.drupal.org/8).