An authentication bypass exists in the Drupal Domain Login Restrict module, which is designed to restrict user logins on multi-domain sites to only assigned domains. The module fails to sufficiently enforce these restrictions when a user authenticates via a method other than the standard login form. Exploitation requires the attacker to possess a valid user account and for the "Enable restriction" setting to be active on the Domain settings page. Users granted the "Login to any domain" permission are not impacted.