Domain Login Restrict EUVD-2026-113523

Requires a Drupal site running the Domain Login Restrict contrib module (versions 0.0.0 through before 1.5.0) with its domain-based login restriction actively configured - the vulnerability is specific to that restriction feature. Per the CVSS vector (PR:L), exploitation requires a low-privilege authenticated account rather than a fully anonymous attacker, which limits the attacker population to users who already have some restricted access. The exact alternate path or channel that triggers the bypass is not described in the available sources. Limiting factors: the module must be installed and enforcing restrictions, and sites on 1.5.0 or later are not affected.

This is a moderate-severity (CVSS 5.4) authentication-bypass flaw (CWE-288, Authentication Bypass Using an Alternate Path or Channel) in the Drupal contrib module Domain Login Restrict. The signals are consistent and point to low real-world urgency: the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity flaw that nonetheless requires some level of privilege (PR:L), and impact is limited (C:L/I:L, no availability impact). EPSS is very low at 0.19% (9th percentile), the CVE is NOT on CISA KEV, and no exploit or PoC reference is present in the input - so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', indicating a routine patch cadence rather than emergency action. One point to verify: the weakness class is an authentication bypass, yet the official vector assigns PR:L (requiring a logged-in but restricted account) rather than PR:N; this is self-consistent for a module that layers a domain-based restriction on top of Drupal's existing authentication, but the exact privilege prerequisite should be confirmed against the Drupal advisory. Overall this is a real but low-priority issue: a niche module, limited impact, no evidence of exploitation.

An attacker who holds a low-privilege account subject to the module's domain-based login restriction uses an alternate path or channel to reach the authenticated area the module is supposed to block, gaining access that the restriction policy should have denied. The precise request or channel used to bypass the control is not described in the available sources. No public exploit or PoC is identified at time of analysis.