CVE-2025-13986
📋 TL;DR
This vulnerability allows attackers to bypass authentication in Drupal sites using the Disable Login Page module by exploiting an alternate path or channel. It affects all Drupal sites running vulnerable versions of the Disable Login Page module. Attackers could gain unauthorized access to administrative functions or protected content.
💻 Affected Systems
- Drupal Disable Login Page module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise through administrative access, data theft, content manipulation, or malware injection.
Likely Case
Unauthorized access to protected content or functionality, potential privilege escalation if combined with other vulnerabilities.
If Mitigated
Limited impact if strong network controls, monitoring, and principle of least privilege are implemented.
🎯 Exploit Status
CWE-288 vulnerabilities typically involve simple path manipulation or parameter tampering.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.3
Vendor Advisory: https://www.drupal.org/sa-contrib-2025-124
Restart Required: No
Instructions:
1. Update Disable Login Page module to version 1.1.3 via Drupal's update manager or Composer. 2. Clear Drupal caches. 3. Verify module functionality remains intact.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the Disable Login Page module until patching is possible
drush pm:disable disable_login_page
Implement web application firewall rules
allBlock suspicious authentication bypass attempts at the WAF level
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Enable detailed authentication logging and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Drupal's module list for Disable Login Page version 1.1.2 or earlierCheck Version:
drush pm:list | grep disable_login_pageVerify Fix Applied:
Confirm Disable Login Page module version is 1.1.3 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts, access to protected paths without proper authentication, failed login attempts from unexpected sources
Network Indicators:
- HTTP requests attempting to bypass authentication endpoints, unusual parameter patterns in authentication requests
SIEM Query:
source="drupal" AND (event_type="authentication" OR event_type="access_denied") AND status="success" FROM unexpected_ip_ranges