According to the CVE description, there is an issue in the Drupal Brute force attack protection module that allows an attacker to perform an action that undermines the module’s intended control over authentication attempts. The vulnerability is categorized as CWE‑307, indicating an improper restriction of authentication attempts. Because it is tied to the authentication process, repeated credential guesses may be possible without the protection that the module is designed to enforce.

The flaw impacts all instances of the Brute force attack protection module, a component of Drupal. All Drupal installations that have this module enabled are potentially vulnerable, regardless of the specific version number. Sites that rely on the module to limit login attempts are at risk.

The CVSS score of 5.9 places the issue in the moderate severity range, while the EPSS score of less than 1% indicates a low probability of exploitation in the field. It is not currently cataloged in the CISA KEV list. The likely attack vector is remote web‑based authentication attempts against the Drupal login interface, inferred from the nature of the module; exploiting the flaw would allow an attacker to bypass or defeat the module’s logic that restricts the number of login attempts.