A vulnerability in the Drupal Disable Login Page module permits authenticated attackers to bypass security controls, potentially leading to unauthorized functionality access.

This is an authentication bypass vulnerability (CWE-288) that occurs due to an alternate path or channel, allowing an attacker with low privileges to circumvent established access controls.

Successful exploitation of this flaw allows an attacker with low privileges to access functionality that should otherwise be restricted. While the CVSS score of 7.5 indicates a high severity, the requirement for an existing low-level account somewhat limits the immediate scope for unauthenticated actors. However, unauthorized access to administrative or restricted features can lead to configuration tampering, data exposure, or further compromise of the Drupal environment.

Immediate Action: Update the Disable Login Page module to version 1.1.3 or later as specified in the official Drupal security advisory.

Proactive Monitoring: Review web server and Drupal access logs for suspicious patterns or unexpected attempts to reach restricted administrative endpoints.

Compensating Controls: Ensure that Web Application Firewall (WAF) rules are configured to restrict access to sensitive administrative paths, providing a layer of defense while the update is applied.

Public Exploit Available: No (exploit_available: false)

The vulnerability presents a significant risk to the integrity of the Drupal installation by allowing authenticated users to exceed their intended permissions. Administrators should prioritize updating the Disable Login Page module to version 1.1.3 immediately to close this security gap. Given the nature of authentication bypass flaws, failure to patch may allow attackers to escalate their capabilities within the application.