CVE-2025-13986

CVE-2025-13986 concerns the Drupal Disable Login Page module (versions prior to 1.1.3), where an authentication bypass occurs via an alternate path or channel, enabling a user to bypass the UI login requirement. Public disclosures across multiple sources (NVD, CVE lists, and OSV) confirm the core...

CVE-2026-16647

Drupal Disable Login Page (versions 0.0.0 through 1.1.4) contains an Authentication Bypass Using an Alternate Path or Channel flaw. The root cause is a cache invalidation failure : when the module enables login page access restrictions, it does not clear previously cached login page responses. An...