Disable Login Page
Monthly
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. The vendor-assessed CVSS vector (PR:H, S:C, C:L) indicates scope change into Drupal core's login component, with low confidentiality exposure and no patch-related active exploitation identified; EPSS at 0.19% (9th percentile) reflects negligible current threat activity.
Improper input validation in the Drupal 'Disable Login Page' contrib module (all versions) enables a network-delivered attack that can achieve high confidentiality and integrity compromise within a Drupal site. Exploitation is substantially constrained by the requirement for high-privilege (administrator-level) access, high attack complexity, and mandatory user interaction - making this a meaningful internal-threat or privilege-abuse scenario rather than an opportunistic remote attack. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.14% (4th percentile) confirms negligible observed exploitation activity at time of analysis.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3. [CVSS 4.2 MEDIUM]
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. The vendor-assessed CVSS vector (PR:H, S:C, C:L) indicates scope change into Drupal core's login component, with low confidentiality exposure and no patch-related active exploitation identified; EPSS at 0.19% (9th percentile) reflects negligible current threat activity.
Improper input validation in the Drupal 'Disable Login Page' contrib module (all versions) enables a network-delivered attack that can achieve high confidentiality and integrity compromise within a Drupal site. Exploitation is substantially constrained by the requirement for high-privilege (administrator-level) access, high attack complexity, and mandatory user interaction - making this a meaningful internal-threat or privilege-abuse scenario rather than an opportunistic remote attack. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.14% (4th percentile) confirms negligible observed exploitation activity at time of analysis.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3. [CVSS 4.2 MEDIUM]