SA-CONTRIB-2026-110: Critical severity drupal/disable_login vulnerability
This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism.
Credit
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs the ability to make repeated requests that guess the secret key required to access the /user/login form. The weakness is that those guesses are not sufficiently restricted.
Are sites using this module exposed by default?
The affected access-control mechanism is the module's secret-key protection for /user/login. A site is exposed if it relies on that mechanism and does not otherwise sufficiently limit repeated secret-key guesses.
What can be done while a fix is not available?
Apply independent controls that restrict repeated attempts to reach or guess the secret key for /user/login, such as rate limiting or other request-throttling protections. The goal is to prevent brute-force guessing of the key.