CVE-2025-13986 Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124
Attackers can bypass authentication restrictions in the Disable Login Page module, potentially gaining unauthorized access to protected areas.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13986?
CVE-2025-13986 is a medium-severity authentication bypass vulnerability in Drupal Disable Login Page, published on 28 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.
Weakness: CWE-288
Which versions are affected by CVE-2025-13986?
It affects 1 product.
Linux distribution packages (1)
drupal/disable_login Packagist:https://packages.drupal.org/8 | All versions | 1.1.3 |
Products include Zyxware Disable Login Page.
How do I fix CVE-2025-13986?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-13986 being exploited?
There is no known exploitation of CVE-2025-13986 in the wild and no public exploit code.
Other vulnerabilities in Drupal Disable Login Page
Sources
Also known as DRUPAL-CONTRIB-2025-124, GHSA-xqc5-rp7m-624q.