Web applications rely heavily on robust authentication to protect user data and maintain site integrity. When these systems have flaws, it can create openings for unauthorized access. A recently identified vulnerability in the Drupal “Disable Login Page” module, tracked as CVE-2025-13986, highlights such a risk, allowing for a bypass of standard authentication processes.
CVE Details
This vulnerability affects the Drupal Disable Login Page module. It was first publicly disclosed on January 28, 2026, and is currently marked as “Analyzed.”
Affected Products
The “Authentication Bypass Using an Alternate Path or Channel” flaw impacts versions of the Drupal “Disable Login Page” module ranging from 0.0.0 up to, but not including, 1.1.3. If you are running any version within this range, your Drupal site could be at risk.
Current Status
The vulnerability has been thoroughly “Analyzed” by security researchers and the Drupal community. This means the nature of the flaw is well understood, and appropriate actions can be taken to mitigate the risk.
Severity Level
CVE-2025-13986 has been assigned a “Medium” severity rating, with a CVSS score of 4.2. While not a critical severity, a medium rating for an authentication bypass still indicates a significant concern. An attacker could potentially exploit this flaw to gain unauthorized access to certain functionalities or areas of a Drupal website that are normally protected by login credentials. This could lead to data exposure, unauthorized actions, or other detrimental impacts depending on the specific configuration and other modules in use.
Possible Solutions
The most crucial step to protect your Drupal site from CVE-2025-13986 is to update the “Disable Login Page” module immediately. Users should upgrade to version 1.1.3 or any subsequent release, as these versions contain the necessary patch to resolve the authentication bypass vulnerability. Always ensure that your Drupal core and all contributed modules are kept up-to-date to benefit from the latest security fixes. Regularly backing up your site before performing updates is also a recommended best practice.
References
https://www.drupal.org/sa-contrib-2025-124
