CVE-2026-11915: Drupal Auth Bypass Vulnerability

CVE-2026-11915 Overview

CVE-2026-11915 affects the Drupal Brute force attack protection contributed module. The vulnerability is classified under CWE-307: Improper Restriction of Excessive Authentication Attempts. The flaw undermines the module's core function of rate-limiting authentication attempts against Drupal sites.

The issue carries a CVSS 3.1 score of 5.9 and requires high privileges plus high attack complexity to exploit. Successful exploitation impacts confidentiality and integrity of the affected Drupal installation. Details are published in the Drupal Security Advisory.

Critical Impact
Attackers who bypass the intended brute force protection can conduct sustained credential guessing against Drupal accounts, leading to account takeover and compromise of protected content.

Affected Products

Drupal contributed module: Brute force attack protection
Drupal sites relying on this module for authentication rate limiting
Refer to the vendor advisory for exact affected version ranges

Discovery Timeline

2026-07-10 - CVE-2026-11915 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-11915

Vulnerability Analysis

The Brute force attack protection module is designed to detect and throttle repeated failed authentication attempts against Drupal login endpoints. CVE-2026-11915 documents a weakness in that enforcement logic, mapped to CWE-307. When the protection fails to properly count, persist, or evaluate failed attempts, attackers regain the ability to submit large volumes of authentication requests without triggering lockout.

The attack vector is Network, meaning exploitation occurs remotely against the Drupal HTTP interface. The high attack complexity indicates that specific conditions must be met before the bypass succeeds, and the required high privileges suggest the attacker must already hold an authenticated role before manipulating the protection state.

Once the throttling is bypassed, both confidentiality and integrity impacts are high because compromised accounts can read restricted content and modify site data. Availability is unaffected because the flaw does not crash the service.

Root Cause

The root cause is improper restriction of excessive authentication attempts within the module's tracking logic. The security check does not reliably block repeated login submissions under the conditions described in the advisory. See the Drupal Security Advisory for module-specific technical detail.

Attack Vector

An authenticated attacker with elevated privileges sends crafted authentication requests to the Drupal login handler. By evading the counter or lockout enforcement in the module, the attacker performs brute force guessing against other accounts. The advisory should be consulted for the specific request pattern that triggers the bypass.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-11915 at the time of publication. The EPSS score is 0.192%, reflecting low near-term exploitation probability.

Detection Methods for CVE-2026-11915

Indicators of Compromise

Elevated volumes of failed login events against /user/login originating from a small set of source IPs or session identifiers
Successful authentications immediately preceded by many failures from the same origin, without a corresponding lockout event
Absence of expected flood or brute force protection log entries during periods of high failed authentication activity

Detection Strategies

Correlate Drupal watchdog authentication logs with web server access logs to identify login attempt volumes that should have triggered lockout
Alert on any authenticated session that generates repeated Login attempt failed messages for multiple usernames
Baseline normal login failure rates per source and flag statistical anomalies

Monitoring Recommendations

Forward Drupal logs and web server logs to a centralized SIEM for retention and correlation
Track invocations of the Brute force attack protection module's enforcement hooks to confirm they run on every login attempt
Monitor privileged account activity for signs of lateral credential probing following privilege assignment

How to Mitigate CVE-2026-11915

Immediate Actions Required

Review the Drupal Security Advisory SA-CONTRIB-2026-047 and identify affected module versions in your environment
Update the Brute force attack protection module to the fixed release identified in the advisory
Audit privileged Drupal accounts and rotate credentials for any account showing suspicious login patterns

Patch Information

The fix is delivered through the Drupal contributed module release referenced in SA-CONTRIB-2026-047. Apply the updated module version using standard Drupal update procedures such as composer update followed by drush updatedb and cache rebuild.

Workarounds

Enable Drupal core's built-in flood control for user login as a compensating rate-limit layer
Place a web application firewall or reverse proxy rule in front of /user/login to enforce request rate limits per source IP
Restrict administrative and elevated roles to trusted users and require multi-factor authentication for those accounts

bash

# Update the Drupal contributed module using Composer and Drush
composer update drupal/brute_force_attack_protection --with-dependencies
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild