CVE-2026-1917: Drupal Login Disable Auth Bypass Flaw

CVE-2026-1917 Overview

CVE-2026-1917 is an Authentication Bypass Using an Alternate Path or Channel vulnerability affecting the Drupal Login Disable module. This vulnerability allows attackers to bypass authentication controls through alternate paths or channels, enabling functionality bypass that could compromise access control mechanisms on affected Drupal sites.

The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), which occurs when a product implements security measures that can be circumvented by accessing functionality through alternative routes not protected by the same authentication requirements.

Critical Impact

Attackers with low-level privileges can exploit this vulnerability to bypass login restrictions, potentially gaining unauthorized access to protected functionality on Drupal sites using the Login Disable module.

Affected Products

• Drupal Login Disable module versions from 0.0.0 before 2.1.3

Discovery Timeline

• 2026-03-25 - CVE-2026-1917 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-1917

Vulnerability Analysis

The Login Disable module for Drupal is designed to temporarily prevent users from logging in to a Drupal site, useful for maintenance windows or other administrative scenarios. However, the vulnerability allows users to circumvent this login restriction through an alternate authentication path or channel.

The root cause stems from incomplete coverage of authentication endpoints within the module. When Login Disable is activated, certain authentication pathways may not be properly blocked, allowing users to authenticate through alternative methods that bypass the intended restriction.

This vulnerability requires network access and low-level privileges to exploit, but does not require user interaction. The impact is limited to confidentiality exposure, where an attacker could potentially access information they should not have access to when the login functionality is supposed to be disabled.

Root Cause

The vulnerability exists due to CWE-288: Authentication Bypass Using an Alternate Path or Channel. The Login Disable module fails to properly secure all authentication endpoints, leaving alternative paths available that do not enforce the login restriction. This architectural oversight means that while the primary login mechanism may be disabled, secondary or alternative authentication routes remain accessible.

Attack Vector

The attack is network-based and requires an attacker to have low-level authenticated access to the system. The attacker can exploit this vulnerability by:

1. Identifying alternate authentication endpoints that are not protected by the Login Disable module
2. Sending authentication requests through these unprotected channels
3. Successfully authenticating and bypassing the login restriction that administrators intended to enforce

Since no proof-of-concept code is publicly available for this vulnerability, the specific exploitation mechanics depend on the alternate path discovered. Security teams should review the Drupal Security Advisory for detailed technical information about affected endpoints.

Detection Methods for CVE-2026-1917

Indicators of Compromise

• Successful authentication events occurring while Login Disable module is supposed to be active
• Login attempts through non-standard authentication endpoints or API routes
• User session creations during maintenance windows when logins should be blocked

Detection Strategies

• Monitor authentication logs for successful logins during periods when the Login Disable module is enabled
• Implement web application firewall (WAF) rules to alert on authentication attempts to alternate login endpoints
• Review Drupal watchdog logs for unexpected authentication activity patterns

Monitoring Recommendations

• Enable detailed logging for all authentication-related Drupal modules
• Set up alerts for authentication events during designated maintenance periods
• Monitor for unusual API authentication traffic patterns that bypass standard login forms

How to Mitigate CVE-2026-1917

Immediate Actions Required

• Update the Drupal Login Disable module to version 2.1.3 or later immediately
• Review authentication logs to identify potential exploitation during the vulnerable period
• Consider temporarily disabling the Login Disable module until the patch can be applied if immediate patching is not possible

Patch Information

The vulnerability is resolved in Drupal Login Disable module version 2.1.3. Organizations should update to this version or later to remediate the vulnerability. For detailed patch information and installation instructions, refer to the Drupal Security Advisory.

Workarounds

• If immediate patching is not possible, consider implementing additional authentication controls at the web server or reverse proxy level during maintenance windows
• Use IP-based access restrictions to limit access to authentication endpoints during periods when Login Disable should be active
• Implement network-level controls to block access to the Drupal site entirely during maintenance, rather than relying solely on the Login Disable module

# Example: Update Drupal Login Disable module via Composer
composer update drupal/login_disable

# Verify the installed version
composer show drupal/login_disable | grep versions