Login Disable
Monthly
Brute-force credential attacks against Drupal sites running the Login Disable contrib module (versions 0.0.0 through 2.1.4) are enabled by the module's failure to restrict excessive authentication attempts (CWE-307). The module, intended to provide administrators with login-gating controls, paradoxically omits rate-limiting enforcement, allowing a low-privileged attacker to enumerate or compromise user credentials via automated requests. EPSS is low (0.21%, 12th percentile) and no active exploitation is confirmed in CISA KEV, but the network-accessible attack vector and low complexity keep this relevant for sites where the module is deployed.
The Drupal Login Disable module contains an authentication bypass vulnerability (CWE-288) that allows attackers to circumvent login restrictions through an alternate authentication path or channel. This affects Login Disable versions prior to 2.1.3, enabling attackers to bypass intended functionality that disables user logins. While CVSS and EPSS scores are not available from public sources, the vulnerability has been formally documented by the Drupal security team, indicating a substantive security concern that requires patching.
Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.0.0 before 2.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the user_logout function, which allows remote attackers to bypass the logout protection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Brute-force credential attacks against Drupal sites running the Login Disable contrib module (versions 0.0.0 through 2.1.4) are enabled by the module's failure to restrict excessive authentication attempts (CWE-307). The module, intended to provide administrators with login-gating controls, paradoxically omits rate-limiting enforcement, allowing a low-privileged attacker to enumerate or compromise user credentials via automated requests. EPSS is low (0.21%, 12th percentile) and no active exploitation is confirmed in CISA KEV, but the network-accessible attack vector and low complexity keep this relevant for sites where the module is deployed.
The Drupal Login Disable module contains an authentication bypass vulnerability (CWE-288) that allows attackers to circumvent login restrictions through an alternate authentication path or channel. This affects Login Disable versions prior to 2.1.3, enabling attackers to bypass intended functionality that disables user logins. While CVSS and EPSS scores are not available from public sources, the vulnerability has been formally documented by the Drupal security team, indicating a substantive security concern that requires patching.
Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.0.0 before 2.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the user_logout function, which allows remote attackers to bypass the logout protection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.