Drupal Shield suffers from an Improper Restriction of Excessive Authentication Attempts flaw that permits attackers to perform brute‑force login attempts. The vulnerability allows an unauthenticated user to bypass normal login throttling, potentially gaining access to accounts with valid credentials. This weakness is identified as CWE‑307 and may compromise confidentiality by enabling unauthorized account access.

All installations of Drupal Shield from version 0.0.0 up through 1.9.0 are affected. Users should verify the deployed module version and ensure it has been upgraded beyond the stated range.

The CVSS score is not supplied, and EPSS is not available, so the exact severity and exploitation probability cannot be precisely quantified. However, the flaw was classified as moderately critical and is listed in Drupal's SA‑CONTRIB advisory, indicating readiness for exploitation over the network via standard authentication endpoints. Based on the description that brute‑force login attempts are possible, it is inferred that the likely attack vector is remote via the module's authentication endpoints. The vulnerability is thus exploitable remotely and could lead to account takeover if no additional controls are in place.