Login Disable CVE-2026-1917

Risk assessment is constrained by the absence of CVSS score, CVSS vector, and EPSS probability data. However, multiple signals indicate genuine concern: (1) the vulnerability was formally reported by the Drupal security team via an official security advisory (drupal.org/sa-contrib-2026-008), suggesting it met Drupal's threshold for a security issue; (2) authentication bypass vulnerabilities are inherently high-impact, as they directly undermine access control; (3) the CWE-288 classification indicates a logic-level flaw that is typically less complex to exploit than cryptographic attacks; (4) the affected version range (0.0.0 to <2.1.3) suggests the vulnerability may have existed for an extended period, increasing the likelihood of exploitation in the wild. The absence of CVSS/EPSS does not diminish risk—it reflects incomplete public disclosure. For organizations using Login Disable in production, especially in security-sensitive contexts, this warrants immediate patching regardless of quantified scores. The vulnerability is not marked as KEV or with POC availability in available sources, but the official Drupal advisory suggests it has sufficient detail for vendor remediation and likely for competent exploitation.

An attacker targeting a Drupal installation with Login Disable module <2.1.3 recognizes that the login form is restricted but discovers an alternate authentication path—such as REST API authentication, programmatic token generation, or a legacy authentication endpoint—that is not subject to the login-disable restriction. The attacker uses this alternate path to obtain valid session credentials or API tokens, effectively bypassing the intended login restriction without requiring knowledge of user passwords or exploitation of complex cryptographic flaws. This could occur within minutes of reconnaissance and would allow the attacker to gain unauthorized access to accounts or functionality that should be inaccessible.