{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-3129","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-3129\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-3129\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/1591526","id":"1591526","resource":"node"},"field_sa_advisory_id":"028","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mcdruid\u0022 rel=\u0022nofollow\u0022\u003EDrew Webber (mcdruid)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Complex\/A:None\/CI:Some\/II:Some\/E:Theoretical\/TD:Default","field_sa_description":{"value":"\u003Cp\u003EThis module enables users to log in using a short access code instead of providing a username\/password combination.\u003C\/p\u003E\n\u003Cp\u003EThe module doesn\u0027t sufficiently protect against brute force attacks to guess a user\u0027s access code.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that access code based logins are off by default and only enabled for accounts that enable it. Sites could mitigate the issue without updating by:\u003C\/p\u003E\n\u003Col\u003E\n\u003Cli\u003Edisabling the access code login method for critical accounts\u003C\/li\u003E\n\u003Cli\u003Emonitor and prevent brute force attacks in other ways (for example, with a Web Application Firewall)\u003C\/li\u003E\n\u003C\/ol\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/glekli\u0022 rel=\u0022nofollow\u0022\u003EGergely Lekli (glekli)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/marcin-maruszewski\u0022 rel=\u0022nofollow\u0022\u003EMarcin Maruszewski (marcin maruszewski)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the access_code module for Drupal 8.x or later, upgrade to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/access_code\/releases\/2.0.4\u0022 rel=\u0022nofollow\u0022\u003Eaccess_code 2.0.4\u003C\/a\u003E\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Access bypass","field_issue_last_status_change":"1743613352","field_sa_cve":["CVE-2025-3129"],"field_is_psa":"0","field_affected_versions":"\u003C2.0.4","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3516840","id":"3516840","resource":"node"}],"nid":"3516922","vid":"13943961","is_new":false,"type":"sa","title":"Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2025-028","edit_url":"https:\/\/www.drupal.org\/node\/3516922\/edit","status":"1","promote":"0","sticky":"0","created":"1743613352","changed":"1743613352","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16052578","id":16052578,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16052579","id":16052579,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16052580","id":16052580,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16052581","id":16052581,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16052590","id":16052590,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1743613352"}]}