PT-2026-6544 · Drupal+1 · Login Disable+1

Boris Doesborg + 3 · Publicado 2026-02-04 · Atualizado 2026-03-25 · CVE-2026-1917

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal Login Disable versions prior to 2.1.3

Description A flaw exists in the Login Disable module where the access key check is bypassed when using the HTTP request login route. This allows users to log in without providing the required access key, potentially compromising site security.

Recommendations Update the Login Disable module to version 2.1.3 or later.

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2026-1917

DRUPAL-CONTRIB-2026-008

Produtos afetados

Login Disable

Drupal Login Disable

Referências · 3

• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-008 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-1917 · Nota de Segurança
• https://drupal.org/sa-contrib-2026-008 · Nota