CVE-2025-13986: Drupal Disable Login Page Auth Bypass

CVE-2025-13986 Overview

CVE-2025-13986 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) affecting the Drupal Disable Login Page module. This security flaw allows attackers to bypass authentication mechanisms through an alternate path or channel, effectively circumventing the intended security controls implemented by the module. The vulnerability enables functionality bypass, allowing unauthorized access to protected resources that should be restricted by the login page disabling feature.

Critical Impact
Attackers can bypass authentication controls in the Drupal Disable Login Page module, potentially gaining unauthorized access to sensitive information or protected functionality on affected Drupal installations.

Affected Products

Drupal Disable Login Page module versions from 0.0.0 before 1.1.3

Discovery Timeline

2026-01-28 - CVE CVE-2025-13986 published to NVD
2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-13986

Vulnerability Analysis

This vulnerability falls under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), which occurs when a product requires authentication but provides an alternate path or channel that does not require authentication. In the context of the Drupal Disable Login Page module, the intended functionality is to disable or restrict access to the standard login page. However, the vulnerability allows attackers to circumvent this protection by accessing authentication mechanisms through an unprotected alternate route.

The attack can be executed remotely over the network without requiring any prior authentication or user interaction, making it particularly dangerous for publicly accessible Drupal installations that rely on this module for access control.

Root Cause

The root cause of this vulnerability lies in incomplete access control implementation within the Drupal Disable Login Page module. The module fails to adequately protect all authentication entry points, leaving alternate paths or channels accessible even when the primary login page is disabled. This oversight allows attackers to discover and exploit these unprotected routes to bypass the intended authentication restrictions.

Attack Vector

The attack vector for CVE-2025-13986 is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a Drupal installation using the vulnerable Disable Login Page module
Discovering alternate authentication paths or channels that bypass the disabled login page
Accessing the unprotected route to bypass authentication controls
Gaining unauthorized access to sensitive information or protected functionality

The vulnerability allows for high confidentiality impact, potentially exposing sensitive data that should be protected behind authentication. For detailed technical information about the vulnerability and exploitation methods, refer to the Drupal Security Advisory.

Detection Methods for CVE-2025-13986

Indicators of Compromise

Unusual authentication attempts or successful logins through non-standard URL paths
Access logs showing requests to alternate login endpoints that should be disabled
Unexpected session creation events without corresponding standard login page activity
Authentication events from IP addresses or user agents not associated with legitimate users

Detection Strategies

Monitor web server access logs for requests to authentication-related endpoints that bypass the standard login page
Implement web application firewall (WAF) rules to detect and alert on authentication bypass attempts
Review Drupal watchdog logs for anomalous authentication events or session creation patterns
Configure intrusion detection systems to alert on unexpected access patterns to protected resources

Monitoring Recommendations

Enable comprehensive logging for all authentication-related activities in Drupal
Set up real-time alerting for authentication events from unexpected sources or paths
Regularly audit user sessions and access patterns to identify potential unauthorized access
Monitor for reconnaissance activities targeting alternate authentication endpoints

How to Mitigate CVE-2025-13986

Immediate Actions Required

Update the Drupal Disable Login Page module to version 1.1.3 or later immediately
Audit access logs to identify any potential exploitation attempts prior to patching
Review user accounts and sessions for signs of unauthorized access
Consider temporarily disabling the vulnerable module until the patch can be applied

Patch Information

The vulnerability has been addressed in Drupal Disable Login Page module version 1.1.3. Site administrators should update to this version or later as soon as possible. The security advisory is available at the Drupal Security Advisory page.

To update the module using Composer:

bash

# Update the Disable Login Page module to the patched version
composer update drupal/disable_login_page

# Clear Drupal cache after update
drush cr

Workarounds

Temporarily disable the Disable Login Page module if immediate patching is not possible
Implement additional access controls at the web server or reverse proxy level to restrict authentication endpoints
Use a Web Application Firewall (WAF) to block requests to known alternate authentication paths
Enable IP-based access restrictions for administrative and authentication functions