SA-CONTRIB-2026-111: Critical severity drupal/disable_login vulnerability
This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared. An attacker may continue to access the login page despite the restriction having been enabled.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Clear relevant caches after enabling login page access restrictions, because previously cached /user/login responses may remain accessible until caches are cleared.
Event History
Frequently Asked Questions
When can the restriction fail to take effect for an attacker?
The issue applies when login page responses were cached before login access restrictions were enabled. Those cached responses can remain accessible until the relevant caches are cleared.
What should administrators do immediately after enabling the restriction?
Clear the relevant caches. This removes previously cached login page responses that could otherwise continue to permit access.