AIKIDO-2026-973797
drupal/login_disable is vulnerable to Access Bypass
58
Medium Risk
This Affects:
drupal/login_disableTL;DR
The Login Disable module prevents users from logging in to your Drupal site unless they know the secret key to add to the end of the login form page. The module doesn't sufficiently protect the disabled login form from brute force attacks. Depending on the length of the key this could allow an attacker to use a brute force attack to bypass the protection provided by this module. The security fix blocks these attempts with flood control.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
drupal/login_disable is vulnerable to Access Bypass in versions 0.0.1 - 2.1.3.
How to fix this
Upgrade the drupal/login_disable module to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant