CVE-2026-18260

Awaiting Analysis Awaiting Analysis - Queue

Disable Login Page Authentication Bypass

Publication date: 2026-08-25

Last updated on: 2026-09-02

Assigner: Drupal.org

Description

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-02

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-18260

EUVD

EUVD-2026-66199

Affected Vendors & Products

Vendor	Product	Version / Range
drupal	disable_login_page	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Drupal Disable Login Page module. It allows unauthorized access to the login page due to improper restrictions in versions up to and including *.*. This could permit attackers to bypass login mechanisms.

Impact Analysis

An attacker could exploit this to gain unauthorized access to a Drupal site, potentially leading to data breaches, defacement, or further compromise of the system. Users may face unauthorized actions or loss of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties or reputational damage.

Hi! I’m here to help you understand CVE-2026-18260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70