CVE-2026-16647 Overview
CVE-2026-16647 is an authentication bypass vulnerability in the Drupal Disable Login Page contributed module. The flaw permits attackers to bypass the module's login-blocking functionality by reaching authentication endpoints through an alternate path or channel. All versions from 0.0.0 through 1.1.4 are affected. The weakness is classified under [CWE-288: Authentication Bypass Using an Alternate Path or Channel].
Critical Impact
Attackers can bypass the module's intended login restrictions and reach authentication functionality that administrators expected to be disabled.
Affected Products
- Drupal Disable Login Page module versions 0.0.0 through 1.1.4
- Drupal sites relying on this module to gate access to the login page
- Any deployment using Disable Login Page as a compensating control for restricting authentication surface
Discovery Timeline
- 2026-09-02 - CVE-2026-16647 published to NVD
- 2026-09-02 - Last updated in NVD database
- Reference: Drupal Security Advisory SA-CONTRIB-2026-111
Technical Details for CVE-2026-16647
Vulnerability Analysis
The Disable Login Page module is designed to hide or block Drupal's default authentication endpoint, typically /user/login, so that only users who know a configured alternate path can reach it. The module enforces this restriction on the primary login route but fails to cover every code path that exposes the same authentication functionality.
Because Drupal exposes login through multiple routes and form handlers, an attacker can request one of the unguarded paths and submit credentials as if the module were not installed. This defeats the security-through-obscurity control the module provides and reintroduces the login surface that operators intended to remove.
The issue is a functionality bypass rather than a credential compromise. Attackers still need valid credentials to authenticate, but brute-force, credential-stuffing, and enumeration attacks against the site become possible again once the alternate path is reached.
Root Cause
The root cause is incomplete route coverage in the module's access control logic. The module intercepts requests to the primary login route but does not enforce the same check on alternate routes, aliases, or form endpoints that resolve to the same authentication workflow. This mismatch is the defining pattern of CWE-288.
Attack Vector
An unauthenticated remote attacker sends an HTTP request to an alternate Drupal endpoint that ultimately invokes the user login form or authentication handler. Because the Disable Login Page module does not enforce its restriction on this path, the request is processed normally and credential submission proceeds. Refer to the Drupal Security Advisory for the specific paths identified by the maintainers.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-16647
Indicators of Compromise
- HTTP requests to Drupal authentication endpoints other than the configured alternate login path
- Successful POST requests carrying login form data on routes that Disable Login Page was configured to block
- Login events in Drupal's watchdog or dblog originating from IPs that never used the sanctioned login URL
Detection Strategies
- Correlate web server access logs against the module's configured allowed login path and alert on any authentication traffic outside that path
- Enable Drupal database logging and monitor for user module login events with unexpected referrers
- Add a WAF or reverse-proxy rule that logs and inspects all requests matching Drupal user or login route patterns
Monitoring Recommendations
- Ingest Apache, Nginx, or reverse-proxy logs into a central analytics platform and baseline normal login-path usage
- Alert on repeated failed authentication attempts sourced from the same IP within short time windows
- Track version metadata for the Disable Login Page module across all Drupal deployments to identify hosts still on 1.1.4 or earlier
How to Mitigate CVE-2026-16647
Immediate Actions Required
- Inventory all Drupal sites and identify installations of the Disable Login Page module at version 1.1.4 or below
- Upgrade to the fixed release referenced in SA-CONTRIB-2026-111
- Restrict access to Drupal authentication routes at the network edge using IP allowlists or VPN gating until patching is complete
- Rotate credentials for administrative accounts if logs indicate authentication attempts through the alternate path
Patch Information
Drupal's security team published advisory SA-CONTRIB-2026-111 covering this issue. Consult the advisory for the fixed version of the Disable Login Page module and apply it through composer or the Drupal update workflow used by your environment.
Workarounds
- Enforce authentication restrictions at the web server or WAF layer by blocking all Drupal login-related routes except those required for legitimate administrative access
- Require multi-factor authentication for all Drupal user accounts so that reaching the login form is insufficient for account takeover
- Temporarily disable the Disable Login Page module and rely on infrastructure-level controls until the patched version is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
