CVE-2026-107256

Name of the Vulnerable Software and Affected Versions Drupal Shield versions 0.0.0 through 1.9.0

Description Drupal Shield fails to sufficiently limit the number of authentication attempts when an anonymous visitor repeatedly submits basic authentication credentials. This allows for brute force attacks against the HTTP basic authentication prompt used to protect non-public sites from being viewed, crawled, or indexed. The risk is reduced if long, randomly generated passwords are used.

Recommendations Update Drupal Shield to a version later than 1.9.0. Use long, randomly generated passwords for Shield credentials to make brute force attempts impractical.