EUVD-2026-69995
GHSA-hcfp-75mm-jggh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Auth bypass of a login-page block is most naturally exercised by unauthenticated users; scope change applies because Drupal core login is the impacted component.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
AnalysisAI
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The 'Disable Login Page' Drupal contributed module (versions 0.0.0-1.1.4) must be installed and enabled on the target Drupal site - this module is not bundled with Drupal core and must be explicitly installed by a site administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the 'Disable Login Page' Drupal module to version 1.1.4 or later, as identified in Drupal SA-contrib-2026-111 (https://www.drupal.org/sa-contrib-2026-111). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Disable Login Page
View allImproper input validation in the Drupal 'Disable Login Page' contrib module (all versions) enables a network-delivered a
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today