CVE-2026-18260
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
- Record
CVE-2026-18260- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-307, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-66199
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
- Record
EUVD-2026-66199- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-96v6-mjqx-wqv5
Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.
Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: ..
- Record
GHSA-96v6-mjqx-wqv5- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-20, CWE-307
- Updated
- 2026-11-02
NVD
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
- Record
CVE-2026-18260- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-307, CWE-20
- Updated
- 2026-11-02
OSV
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
- Record
CVE-2026-18260- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-307
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2026-091 No score
An advisory for this issue has been issued at https://www.drupal.org/sa-contrib-2026-110 and an additional issue was identified and fixed via https://www.drupal.org/sa-contrib-2026-111
This module is now resupported. See that advisory for more details.
Original content
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
- Record
DRUPAL-CONTRIB-2026-091- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2026-110 No score
This module enables you to disable access to the /user/login form unless a secret key is provided.
The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism.
- Record
DRUPAL-CONTRIB-2026-110- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/disable_loginPackagist:https://packages.drupal.org/8 |
before 1.1.4 | 1.1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-18260 is a medium vulnerability (CVSS 5.7) in Drupal Disable Login Page, published July 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in drupal/disable_login 1.1.4.