The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Project:
Date:
2026-August-26
Vulnerability:
Access bypass
Affected versions:
<1.1.4
CVE IDs:
CVE-2026-81269
Description:
This module enables you to disable access to the /user/login form unless a secret key is provided.
The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared. An attacker may continue to access the login page despite the restriction having been enabled.
Solution:
Install the latest version:
- If you use the Disable Login Page module, upgrade to Disable Login Page 1.1.4.
Reported By:
Coordinated By:
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
