Disable Login Page

Disable Login Page

Moderately critical · 1,613 sites report using it · 2 security fixes · Week of 26 August 2026

2 security fixes in one update. Disable Login Page fixed 2 separate security bugs this week: 2 access bypass. One update covers all of them. The most serious, SA-CONTRIB-2026-111, is explained here and the full list is at the end of the card.

Anyone without logging in could still reach the login screen if a copy of it was saved by the website performance system before the restriction was turned on. They could not read any private data or change anything on the site.

• Who could do thisAnyone visiting the site. No login needed.
• Does it apply to youAny site using this module.
• Has it been used in attacksA working example has been published, so assume someone will try.
• How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Disable Login Page to the latest release.

All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.

• Moderately critical · Access bypass · SA-CONTRIB-2026-111
• Moderately critical · Access bypass · SA-CONTRIB-2026-110

Disable Login Page

Critical · 1,613 sites report using it · SA-CONTRIB-2026-091 · on drupal.org · Week of 29 July 2026

This project has been withdrawn because of a security problem its maintainer did not fix. The details are not published. It should be treated as unsafe to keep.

• Who could do thisOnly someone with an administrator login.
• Does it apply to youAny site using this module.
• Has it been used in attacksNo sign of it.
• How urgentThe Drupal security team has withdrawn this module because its maintainer did not fix a known problem. The only remedy is to remove or replace it.

Tell your developerRemove or replace Disable Login Page. There is no fixed version.