CVE-2026-18260 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
Attackers can bypass login restrictions to perform brute force attacks on accounts using the Disable Login Page module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-18260?
CVE-2026-18260 is a medium-severity authentication bypass vulnerability in Drupal Disable Login Page, published on 25 Aug 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
Which versions are affected by CVE-2026-18260?
Linux distribution packages (2)
drupal/disable_login Packagist:https://packages.drupal.org/8 | All versions | 1.1.4 |
drupal/disable_login Packagist:https://packages.drupal.org/8 | All versions | 1.1.4 |
How do I fix CVE-2026-18260?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18260 being exploited?
There is no known exploitation of CVE-2026-18260 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-091, DRUPAL-CONTRIB-2026-110, GHSA-96v6-mjqx-wqv5.