Drupal Login Disable EUVD-2026-43074

Exploitation requires the target Drupal site to have the Login Disable contrib module installed and active in a version prior to 2.1.4. The CVSS vector (PR:L) indicates that the attacker must possess at least a low-privilege authenticated session on the Drupal site - unauthenticated, fully anonymous exploitation is not indicated by the vendor's scoring. The attack is limited by this authentication prerequisite: external threat actors without any existing account cannot directly exploit this flaw unless they first obtain credentials through another means. Sites that already enforce external rate limiting via WAF, CDN, or network controls may be partially protected even without patching.

The official CVSS 3.1 score is 5.4 (Medium), reflecting limited impact (C:L/I:L/A:N) and a requirement for low-privilege authentication (PR:L). The EPSS score of 0.21% at the 12th percentile indicates that automated exploitation in the wild is statistically uncommon, and the vulnerability is not listed in the CISA KEV catalog, meaning no confirmed active exploitation is on record. No public exploit code (POC) is referenced in the available data. The risk is therefore meaningful but not urgent for most organizations: the limiting factor is that the attacker must already hold a low-privilege Drupal account, narrowing the realistic threat actor pool to insiders, compromised accounts, or attackers who have already obtained initial access. For sites using the module with publicly accessible login forms and no external WAF-layer rate limiting, the practical risk is elevated. The tags suggest some Information Disclosure impact, likely via username enumeration as a side effect of repeated failed attempts.

An attacker with a low-privilege Drupal account on a site running Login Disable prior to 2.1.4 submits automated credential-stuffing requests against other user accounts using a leaked password list, exploiting the absence of rate limiting or lockout in the module. Because no throttling is enforced, thousands of attempts can be made in rapid succession without triggering a block, potentially yielding valid credentials for higher-privileged accounts. No public exploit code is referenced in the available data.