CVE-2026-16647
CVE-2026-16647 · Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
CVSS 4.1 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
disable login page
- Versions
- ≥ 0.0.0, < 1.1.4: Affected (semver)
Update to 1.1.4
drupal/disable_login Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.1.4
Update to 1.1.4