CVE-2026-1917
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.
A non-form login endpoint in Drupal 7 contrib could bypass the login form entirely, complete login through Drupal's normal login finalization flow, and avoid the module's access-key check. This is an access control bypass. It allows a user with the bypass permission to log in through a non-form route without supplying the secret URL key that the module is supposed to require during login lockdown.
An authorization control bypass vulnerability occurs when a system fails to properly enforce access controls, allowing an attacker to access resources or perform actions they should not be allowed to access. This can happen due to flaws in the design or implementation of the authentication or authorization mechanisms.
This issue affects all versions of Login Disable from 7.1.0 through 7.1.2.
Details
Module Info
- Product: Drupal 7
- Affected package: Login Disable
- Affected versions: >=7.1.0 <= 7.1.2.
- Repository: https://git.drupalcode.org/project/login_disable
- Project Page: https://www.drupal.org/project/login_disable
- Package manager: Composer
- Fixed in: Login Disable NES 7.1.3 [TODO: Add real link]
Vulnerability Info
This low-severity vulnerability affects all versions of the Login Disable module for Drupal 7.
When the module is active, the normal login form is protected by login_disable_form_user_login_alter(). However, before the fix, login_disable_user_login() did not enforce the configured access key. As a result, a non-form login route could skip the form-level protection and still complete login.
In Drupal 7, the logical generic enforcement point is hook_user_login(), because Drupal 7 does not have the modern core HTTP login route that newer Drupal versions protect directly.
This means the vulnerable behavior is:
- login disable is active
- a user has the `bypass disabled login` permission
- login happens through a non-form route
- the route completes login without the required access key in the query string
Under those conditions, the module fails to enforce its intended access-key restriction.
Addressing the Issue
Users of the affected module should apply one of the following mitigations:
- If an immediate upgrade is not possible, reduce exposure by limiting or disabling non-form login endpoints that may authenticate users while Login Disable is active.
- Put HTTP auth, IP allowlisting, VPN, or reverse-proxy restrictions in front of the site during lockdown.
- Ensure only tightly controlled roles have bypass disabled login.
- Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.
Credits
- Pierre Rudloff (prudloff)
