CVE-2026-16647

Drupal Disable Login Page (versions 0.0.0 through 1.1.4) contains an Authentication Bypass Using an Alternate Path or Channel flaw. The root cause is a cache invalidation failure : when the module enables login page access restrictions, it does not clear previously cached login page responses. An...

CVE-2025-13986

The Drupal Disable Login Page content blocking plugin is vulnerable to an authentication bypass in versions prior to 1.1.3 . The module, designed to disable the standard UI login form (/user/login), fails to block authentication when using the REST/HTTP login route . Consequently, an attacker or ...