Authentication Bypass in Drupal Disable Login Page
CVE-2025-13986

4.2MEDIUM

Key Information:

Vendor

Drupal
Status
Disable Login Page
Vendor
CVE Published:
28 January 2026

What is CVE-2025-13986?

An authentication bypass vulnerability exists in the Disable Login Page module for Drupal, allowing unauthorized users to access functionalities designed to be restricted. This flaw impacts versions 0.0.0 through 1.1.2, enabling potential misuse and abuse of access controls. Admins are advised to update their modules promptly to safeguard their installations.

Affected Version(s)

Disable Login Page 0.0.0 < 1.1.3

References

https://www.drupal.org/sa-contrib-2025-124

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pierre Rudloff (prudloff)
Anoop John (anoopjohn)
Jijo Joseph (jijojoseph_zyxware)
Pierre Rudloff (prudloff)
cilefen (cilefen)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
Jess (xjm)
.