What is the CVSS score of CVE-2025-13986?

CVE-2025-13986 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Disable Login Page are affected by CVE-2025-13986?

CVE-2025-13986 presents moderate security risk rated CVSS 4.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-13986?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Disable Login Page CVE-2025-13986

MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-01-28 mlhess@drupal.org

Authentication Bypass Drupal Disable Login Page

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 20:16 nvd

MEDIUM 4.2

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.

AnalysisAI

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3. [CVSS 4.2 MEDIUM]

Technical ContextAI

Affects the Page allows component of Disable Login Page. Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.