CVE-2025-13986
CVE-2025-13986 · Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.
CVSS 4.2 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
disable login page
- Versions
- ≥ 0.0.0, < 1.1.3: Affected (semver)
Update to 1.1.3
drupal/disable_login Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.1.3
Update to 1.1.3