Brute Force Vulnerability in Drupal Mail Login Affects Multiple Versions
CVE-2025-7393

9.8CRITICAL

Key Information:

Vendor

Drupal
Status
Mail Login
Vendor
CVE Published:
21 July 2025

What is CVE-2025-7393?

The Mail Login module for Drupal has a vulnerability that improperly restricts excessive authentication attempts, allowing attackers to execute brute force attacks. This affects versions prior to 3.2.0 and 4.2.0. To protect your website from unauthorized access, it's crucial to update to the latest version and implement additional security measures.

Affected Version(s)

Mail Login 3.0.0 < 3.2.0

Mail Login 4.0.0 < 4.2.0

References

https://www.drupal.org/sa-contrib-2025-088

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ryugo Kinoshita (dc-kinoshita)
Damien McKenna (damienmckenna)
Mohammad AlQanneh (mqanneh)
Greg Knaddison (greggles)
JSON
.