EUVD-2026-43074
GHSA-v36x-q6gx-86g9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable brute-force attack requiring a low-privilege account; limited confidentiality and integrity impact from credential access, no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
AnalysisAI
Brute-force credential attacks against Drupal sites running the Login Disable contrib module (versions 0.0.0 through 2.1.4) are enabled by the module's failure to restrict excessive authentication attempts (CWE-307). The module, intended to provide administrators with login-gating controls, paradoxically omits rate-limiting enforcement, allowing a low-privileged attacker to enumerate or compromise user credentials via automated requests. EPSS is low (0.21%, 12th percentile) and no active exploitation is confirmed in CISA KEV, but the network-accessible attack vector and low complexity keep this relevant for sites where the module is deployed.
Technical ContextAI
The affected component is the Drupal Login Disable contrib module (CPE: cpe:2.3:a:drupal:login_disable:*:*:*:*:*:*:*:*), a third-party extension for the Drupal CMS that enables site administrators to selectively block or restrict login access. The root cause is CWE-307 - Improper Restriction of Excessive Authentication Attempts - meaning the module fails to implement account lockout, rate limiting, CAPTCHA enforcement, or other anti-automation controls on the authentication endpoint it manages. This is a well-understood vulnerability class: without throttling, authentication interfaces are susceptible to automated credential-stuffing or dictionary attacks. The CVSS vector (AV:N/AC:L/PR:L) confirms the flaw is remotely exploitable with low complexity, though some form of low-privilege access is required per the vendor's scoring.
RemediationAI
The primary fix is to update the Drupal Login Disable module to version 2.1.4 or later, which addresses the lack of authentication-attempt restriction per the vendor advisory at https://www.drupal.org/sa-contrib-2026-070. The patch is confirmed available from the vendor. If immediate patching is not possible, site administrators should implement compensating controls at the infrastructure or Drupal configuration layer: enabling Drupal's Flood Control settings to limit failed login attempts per IP and per user, deploying a WAF or reverse proxy with rate-limiting rules targeting the login endpoint, or temporarily disabling the Login Disable module until the update can be applied. Note that disabling the module may change the site's intended login-gating behavior configured by administrators. External rate limiting (e.g., at the CDN or load balancer layer) is the most reliable short-term workaround without introducing Drupal configuration side effects.
More in Login Disable
View allThe Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the user_lo
The Drupal Login Disable module contains an authentication bypass vulnerability (CWE-288) that allows attackers to circu
Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Se
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today