DRUPAL-CONTRIB-2026-111

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/disable_login/DRUPAL-CONTRIB-2026-111.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-111
Aliases
Published
2026-08-26T17:39:32Z
Modified
2026-08-27T19:30:04.132774056Z
Summary
[none]
Details

This module enables you to disable access to the /user/login form unless a secret key is provided.

The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared. An attacker may continue to access the login page despite the restriction having been enabled.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/disable_login

Package

Name
drupal/disable_login
Purl
pkg:composer/drupal/disable_login?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.4
Database specific
Show details 
{
    "constraint": "<1.1.4"
}

Database specific

source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/disable_login/DRUPAL-CONTRIB-2026-111.json"
affected_versions 
"<1.1.4"