CVE-2026-15079 Overview
CVE-2026-15079 is an Improper Restriction of Excessive Authentication Attempts vulnerability [CWE-307] in the Drupal Login Disable contributed module. The module fails to enforce rate limiting or account lockout controls on authentication endpoints. Attackers with low-privilege access can perform brute-force attacks against user credentials over the network.
The issue affects Login Disable versions 0.0.0 through 2.1.4. Successful exploitation compromises the confidentiality and integrity of targeted accounts. The vulnerability requires no user interaction and is exploitable remotely.
Critical Impact
Attackers can execute unlimited authentication attempts against Drupal accounts protected by the Login Disable module, enabling credential compromise through brute-force attacks.
Affected Products
- Drupal Login Disable module versions 0.0.0 through 2.1.4
- Drupal sites using Login Disable for authentication controls
- Contributed module ecosystem tracked under advisory sa-contrib-2026-070
Discovery Timeline
- 2026-07-10 - CVE-2026-15079 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-15079
Vulnerability Analysis
The Drupal Login Disable module provides functionality to disable user login under specific conditions. It does not implement sufficient controls to restrict the number of failed authentication attempts against a given account or from a given source. Attackers can submit repeated credential guesses without triggering lockouts, delays, or blocks.
The network-exploitable nature of the flaw means attackers only need reachability to the Drupal login form. Because the vulnerability requires a low-privilege authenticated context, attackers who already possess valid low-tier credentials can pivot to escalate access by cracking other accounts. The EPSS probability is 0.209%, reflecting a low current likelihood of observed exploitation.
Root Cause
The root cause is a missing enforcement of authentication attempt thresholds within the Login Disable module. Under [CWE-307], software must track failed authentication events and apply throttling, temporary lockout, or progressive delays. The module lacks these controls up to and including version 2.1.4, permitting unbounded authentication guessing.
Attack Vector
The attack vector is network-based against the Drupal login endpoint. An attacker automates HTTP POST requests to the standard /user/login form, cycling through username and password combinations. Without server-side attempt tracking or lockout enforcement from the Login Disable module, the endpoint continues to process each attempt. Successful credential discovery yields access at the privilege level of the compromised account.
See the Drupal Security Advisory for full technical details.
Detection Methods for CVE-2026-15079
Indicators of Compromise
- High volume of failed authentication events in Drupal watchdog logs originating from a single IP or narrow IP range
- Sequential login attempts against multiple usernames within short time windows
- Successful authentications immediately following bursts of failed attempts on the same account
- Anomalous geolocation or user-agent patterns on /user/login POST requests
Detection Strategies
- Aggregate Drupal authentication logs and alert on failed login rates exceeding baseline thresholds per source IP or account
- Correlate web server access logs for repeated POST requests to /user/login with varying form parameters
- Deploy web application firewall rules that detect credential-stuffing patterns against Drupal endpoints
- Monitor for privilege escalations or session creations that follow burst failed-login sequences
Monitoring Recommendations
- Ingest Drupal application logs, web server access logs, and reverse proxy logs into a centralized analytics platform
- Establish per-account and per-IP baselines for authentication attempt rates
- Alert on any account that experiences more than a defined threshold of failed logins within a rolling window
- Track authentication anomalies against identity telemetry to detect lateral credential abuse
How to Mitigate CVE-2026-15079
Immediate Actions Required
- Upgrade the Login Disable module to a version above 2.1.4 once released per the vendor advisory
- Enforce strong password policies and multi-factor authentication for all Drupal accounts
- Deploy rate limiting at the web server, reverse proxy, or WAF layer against /user/login
- Review authentication logs for signs of prior brute-force activity and reset credentials for affected accounts
Patch Information
Refer to the Drupal Security Advisory for the fixed version and upgrade instructions. Administrators should apply the vendor-supplied update as soon as it is available in their release channel.
Workarounds
- Enable Drupal core's Flood Control settings to throttle failed login attempts by IP and by user
- Configure reverse proxy or WAF rules to block clients exceeding a defined failed-login rate
- Restrict access to /user/login by IP allow-list where feasible for administrative accounts
- Require multi-factor authentication so credential guessing alone cannot yield account access
# Example: enable Drupal flood control limits via Drush
drush config-set user.flood ip_limit 50
drush config-set user.flood ip_window 3600
drush config-set user.flood user_limit 5
drush config-set user.flood user_window 3600
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
