Disable Login Page CVE-2026-16647

The 'Disable Login Page' Drupal contributed module (versions 0.0.0-1.1.4) must be installed and enabled on the target Drupal site - this module is not bundled with Drupal core and must be explicitly installed by a site administrator. The vulnerability is only relevant on sites where hiding the login page is a deliberate security posture. The vendor CVSS vector specifies PR:H, indicating exploitation in the vendor's model requires high-privilege context; this may mean the bypass is exercisable by Drupal administrators navigating alternate routes, or that specific admin-configured paths are involved. Unauthenticated exploitation of the alternate path is not independently confirmed from the available description. There is no user interaction requirement (UI:N). The bypass does not apply to sites that also block alternate login paths at the web-server or network layer independently of this module.

Real-world risk is low. EPSS at 0.19% (9th percentile) indicates negligible measured exploitation probability. There is no CISA KEV listing and no publicly available exploit code identified at time of analysis. The vendor CVSS of 4.1 (PR:H) is the primary tension point: an 'Authentication Bypass' that requires high privileges to exercise is counterintuitive - it may reflect that the bypassing party is a Drupal administrator who can navigate alternate paths even while the module blocks lower-privilege users, or it may reflect Drupal SA's scoring methodology rather than a fully unauthenticated bypass. The scope change (S:C) elevates the vector marginally by acknowledging impact on Drupal core's login surface. Practically, the worst case is that a hidden login page is re-exposed, enabling credential brute-force or enumeration attacks that the module was specifically deployed to prevent. This matters most to sites that use 'Disable Login Page' as a primary control against login-page attacks rather than a supplemental one. Sites with strong credentials, account lockout, and MFA are substantially protected even if the bypass is triggered.

An attacker targeting a Drupal site that has disabled its public login page discovers that an alternate URL path (e.g., /user or a JSON:API authentication endpoint) remains accessible despite the 'Disable Login Page' module being active. The attacker navigates to this alternate path, reaches the Drupal login interface, and proceeds to conduct credential stuffing or brute-force attacks against accounts that were intended to be shielded from direct login-page exposure. No public proof-of-concept is known, but the bypass technique requires only knowledge of Drupal's alternate login paths, which are publicly documented.