Stop Administrator Login CVE-2026-96387

Exploitation targets Drupal sites that have the contributed 'Stop administrator login' module installed and enabled at a version between 1.0 and 1.6. Per the CVSS vector (PR:H), the attacker must already possess high-privilege credentials/access, which is a significant limiting factor; no user interaction is required (UI:N). The flaw is an authentication bypass using an alternate path or channel (CWE-288), i.e. reaching the login flow through a route the module does not protect - the precise alternate channel is not described in the available sources and should be confirmed via the Drupal advisory. Impact is limited to partial confidentiality and integrity (C:L/I:L), with no availability impact.

This is a low-severity issue and the signals are consistent in pointing to low real-world priority. The input CVSS base score is 3.8 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, meaning network-reachable but requiring high existing privileges (PR:H) and yielding only limited confidentiality and integrity impact with no availability impact. EPSS reinforces this with a 0.18% exploitation probability (7th percentile), and the vulnerability is NOT on CISA KEV, so there is no confirmed active exploitation. The vuln.today decision label is 'monitor', which aligns with the low CVSS and low EPSS - this is not act_now or emergency. No PoC or exploit reference is present in the input (the only references are the Drupal security advisory SA-contrib-2026-183 and the NVD/EUVD advisory). The one point worth verifying is the interplay between PR:H and the nature of the flaw: this is a contributed Drupal module whose purpose is to restrict/stop administrator login, and an authentication-bypass-via-alternate-path (CWE-288) against that protection, combined with the PR:H rating, suggests the realistic impact is circumventing the module's intended login restriction rather than a full unauthenticated takeover - confirm the exact prerequisite with the Drupal advisory. Overall: genuinely low priority, not a high-CVSS-but-hidden-risk case.

An attacker who already holds high-privilege credentials on a Drupal site running the 'Stop administrator login' module (versions 1.0 through 1.6) reaches the login flow through an alternate path or channel that the module fails to guard, bypassing the intended login restriction. Because the CVSS vector is AV:N/AC:L/PR:H, the attack is remote and low-complexity but requires that pre-existing privileged access, and the resulting impact is limited (C:L/I:L/A:N). No public exploit code is identified at time of analysis.