Vulnerability from drupal
Published
2025-12-03 18:49
Modified
2025-12-03 18:49
Summary
Details

This module enables you to disable the standard Drupal login form (/user/login) so site owners can prevent interactive logins via the UI.

The module does not sufficiently block authentication when the REST/HTTP login route is used. An attacker (or legitimate user) with valid credentials can authenticate using the REST login endpoint (/user/login?_format=json) or other HTTP-based authentication routes, effectively bypassing the module’s protection of the UI login page.

This vulnerability is mitigated by the fact that an attacker must already possess valid account credentials.

Credits
Pierre Rudloff (prudloff) www.drupal.org/u/prudloff
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.1.3"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/disable_login"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.1.3"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2025-13986"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/prudloff"
      ],
      "name": "Pierre Rudloff (prudloff)"
    }
  ],
  "details": "This module enables you to disable the standard Drupal login form (`/user/login`) so site owners can prevent interactive logins via the UI.\n\nThe module does not sufficiently block authentication when the REST/HTTP login route is used. An attacker (or legitimate user) with valid credentials can authenticate using the REST login endpoint (`/user/login?_format=json`) or other HTTP-based authentication routes, effectively bypassing the module\u2019s protection of the UI login page.\n\nThis vulnerability is mitigated by the fact that an attacker must already possess valid account credentials.",
  "id": "DRUPAL-CONTRIB-2025-124",
  "modified": "2025-12-03T18:49:57.000Z",
  "published": "2025-12-03T18:49:57.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2025-124"
    }
  ],
  "schema_version": "1.7.0"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.