What is the CVSS score of EUVD-2026-15423?

EUVD-2026-15423 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Login Disable are affected by EUVD-2026-15423?

CVE-2026-1917 presents moderate security risk rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-15423?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Login Disable EUVD-2026-15423

| CVE-2026-1917 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-25 drupal

GHSA-j568-7wm8-fm52

Authentication Bypass Login Disable

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 15:46 euvd

EUVD-2026-15423

Analysis Generated

Mar 25, 2026 - 15:46 vuln.today

CVE Published

Mar 25, 2026 - 15:20 nvd

MEDIUM 4.3

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.

AnalysisAI

The Drupal Login Disable module contains an authentication bypass vulnerability (CWE-288) that allows attackers to circumvent login restrictions through an alternate authentication path or channel. This affects Login Disable versions prior to 2.1.3, enabling attackers to bypass intended functionality that disables user logins. While CVSS and EPSS scores are not available from public sources, the vulnerability has been formally documented by the Drupal security team, indicating a substantive security concern that requires patching.

Technical ContextAI

The vulnerability resides in the Drupal Login Disable module (CPE: cpe:2.3:a:drupal:login_disable:*:*:*:*:*:*:*:*), a Drupal contributed module designed to restrict or disable user authentication pathways. The root cause is classified under CWE-288 (Authentication Using an Alternate Path or Channel), which describes flaws where authentication mechanisms can be bypassed by using alternative authentication methods or entry points that were not properly secured or validated. In the context of a login-disable module, this suggests that while the primary login mechanism may be restricted, alternative authentication channels—such as API authentication, administrative backdoors, or session-handling mechanisms—remain accessible without proper validation against the disabled login state. This is a logic flaw rather than a cryptographic weakness, making it particularly dangerous as it subverts the intended security control entirely.

RemediationAI

Immediately upgrade the Drupal Login Disable module to version 2.1.3 or later, following the patch released in the official Drupal security advisory at https://www.drupal.org/sa-contrib-2026-008. For organizations unable to patch immediately, disable the Login Disable module entirely and implement login restrictions at the Drupal core or web server level using alternative authentication controls, such as IP whitelisting, Web Application Firewall (WAF) rules restricting login endpoints, or Apache/Nginx authentication directives. Review authentication logs for any unusual access patterns, alternate authentication attempts, or API calls that may indicate exploitation of the alternate authentication channel. After patching, conduct a security audit of all authentication paths in your Drupal installation to ensure no other bypass mechanisms exist.