CVE-2025-13986: Drupal Disable Login Page Auth Bypass Flaw

CVE-2025-13986 Overview

CVE-2025-13986 is an authentication bypass vulnerability in the Drupal Disable Login Page contributed module published by Zyxware. The flaw allows attackers to bypass the module's intended functionality through an alternate path or channel, mapped to [CWE-288]. All versions from 0.0.0 before 1.1.3 are affected. The vulnerability requires low privileges and high attack complexity, limiting large-scale exploitation. Site administrators who rely on the module to hide or restrict the default Drupal login page should treat the fix as a priority update to restore the intended access control posture.

Critical Impact
Attackers with low-privileged access can bypass the Disable Login Page protections and reach restricted login functionality on affected Drupal sites.

Affected Products

Zyxware Disable Login Page module for Drupal, versions 0.0.0 through 1.1.2
Drupal sites with the Disable Login Page module enabled
Any environment relying on this module as a control to restrict login page exposure

Discovery Timeline

2026-01-28 - CVE-2025-13986 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13986

Vulnerability Analysis

The Disable Login Page module is designed to block or hide the standard Drupal login route, reducing the attack surface available to credential-stuffing and brute-force tooling. CVE-2025-13986 defeats that control by exposing an alternate path or channel that the module fails to intercept. An authenticated user with limited privileges can reach login-related functionality that the administrator expected to be unavailable. The confidentiality and integrity impact is bounded to resources exposed through that path, and the issue does not directly affect availability. The practical risk is highest on sites that treat the module as a security boundary rather than a hardening measure.

Root Cause

The root cause is incomplete coverage of routes and request handlers under [CWE-288] Authentication Bypass Using an Alternate Path or Channel. The module enforces its restrictions on the primary login endpoint but does not consistently apply the same checks to equivalent entry points exposed by Drupal core or related subsystems. Requests routed through those unprotected channels bypass the intended block.

Attack Vector

Exploitation occurs over the network against an affected Drupal site. The attacker must already hold low-level credentials and must craft a request that targets the alternate path rather than the blocked login route. High attack complexity reflects the need to identify the specific bypass channel for the target configuration. No user interaction is required. See the Drupal Security Advisory 2025-124 for vendor-specific technical context.

Detection Methods for CVE-2025-13986

Indicators of Compromise

Successful HTTP requests to login-related routes on sites where the Disable Login Page module should block them.
Authenticated sessions originating from accounts that should not be able to reach login workflows.
Access log entries targeting alternate Drupal authentication endpoints such as REST, JSON:API, or user password reset flows while the module is active.

Detection Strategies

Review Drupal access logs and web server logs for requests to /user, /user/login, /user/password, and API-based authentication endpoints while the module is enabled.
Compare module configuration against actual reachable routes using an authenticated crawl from a low-privileged test account.
Alert on anomalous authentication activity following any administrative change to the Disable Login Page module configuration.

Monitoring Recommendations

Ingest Drupal watchdog and web server logs into a centralized logging platform and build detections for login-route access.
Track the installed version of the Disable Login Page module across all Drupal sites in the estate and flag anything earlier than 1.1.3.
Monitor for repeated low-privilege account activity that touches authentication endpoints, which can indicate reconnaissance for the bypass path.

How to Mitigate CVE-2025-13986

Immediate Actions Required

Upgrade the Disable Login Page module to version 1.1.3 or later on every affected Drupal site.
Audit user accounts and revoke unnecessary low-privileged accounts that could be used to trigger the bypass.
Re-validate that the module's configured restrictions actually block all expected login paths after upgrading.

Patch Information

The vendor has released Disable Login Page version 1.1.3, which addresses CVE-2025-13986. Refer to the Drupal Security Advisory 2025-124 for official patch details and upgrade instructions.

Workarounds

Enforce login page restrictions at the web server or reverse proxy layer using IP allow-lists or authentication rules until the module is upgraded.
Disable the Disable Login Page module and apply equivalent restrictions through a web application firewall if an immediate upgrade is not possible.
Require multi-factor authentication for all Drupal accounts to reduce the impact of any login path that remains reachable.

bash

# Upgrade the Disable Login Page module to the fixed release using Composer
composer require 'drupal/disable_login_page:^1.1.3' --update-with-dependencies
drush updatedb
drush cache:rebuild