EUVD-2026-66199
GHSA-96v6-mjqx-wqv5
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Network vector applies as attack is HTTP-delivered; PR:H reflects mandatory admin-level access; C:H and I:H are supported by Information Disclosure tag and module's access-control role; no availability impact evident.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.
AnalysisAI
Improper input validation in the Drupal 'Disable Login Page' contrib module (all versions) enables a network-delivered attack that can achieve high confidentiality and integrity compromise within a Drupal site. Exploitation is substantially constrained by the requirement for high-privilege (administrator-level) access, high attack complexity, and mandatory user interaction - making this a meaningful internal-threat or privilege-abuse scenario rather than an opportunistic remote attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold high-privilege access within the Drupal instance equivalent to the Drupal administrator role (PR:H) - the vulnerability cannot be triggered by anonymous or standard authenticated users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.7 Medium score reflects a genuinely constrained threat profile: the vector AC:H (high attack complexity), PR:H (administrator-level privileges required), and UI:R (user interaction required) collectively eliminate automated, opportunistic, and unauthenticated exploitation vectors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched version has been confirmed in the available intelligence - the affected version range covers all releases and no explicit fix version is enumerated in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Disable Login Page
View allAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today