CVE-2026-16647 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
Attackers can bypass authentication in the Disable Login Page module, allowing unauthorized access to protected functionality.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-16647?
CVE-2026-16647 is a medium-severity authentication bypass vulnerability in Drupal Disable Login Page, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
Weakness: CWE-288
Which versions are affected by CVE-2026-16647?
It affects 1 product.
Linux distribution packages (1)
drupal/disable_login Packagist:https://packages.drupal.org/8 | All versions | 1.1.4 |
Products include Zyxware Disable Login Page.
How do I fix CVE-2026-16647?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-16647 being exploited?
There is no known exploitation of CVE-2026-16647 in the wild and no public exploit code.
Other vulnerabilities in Drupal Disable Login Page
Sources
Also known as DRUPAL-CONTRIB-2026-111, GHSA-hcfp-75mm-jggh.