Authentication Bypass Vulnerability in Drupal Disable Login Page
CVE-2026-16647

4.1MEDIUM

Key Information:

Vendor

Drupal
Status
Disable Login Page
Vendor
CVE Published:
2 September 2026

What is CVE-2026-16647?

An issue has been identified in the Disable Login Page module for Drupal that allows an authentication bypass through an alternate path or channel. This vulnerability may permit unauthorized users to gain access to restricted functionalities, thereby compromising the integrity of user authentication mechanisms. Specifically, it affects versions from 0.0.0 up to 1.1.4, highlighting the urgency for users to update and secure their installations to prevent potential exploitation.

Affected Version(s)

Disable Login Page 0.0.0 < 1.1.4

References

https://www.drupal.org/sa-contrib-2026-111

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Osborne (bkosborne)
Jason Partyka (partyka)
Brian Osborne (bkosborne)
Jason Partyka (partyka)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
Jess (xjm)
.