CVE-2026-114572

Name of the Vulnerable Software and Affected Versions Drupal Domain Login Restrict versions 0.0.0 through 1.5.0

Description An authentication bypass exists in the Drupal Domain Login Restrict module, which is designed to restrict user logins on multi-domain sites to only assigned domains. The module fails to sufficiently enforce these restrictions when a user authenticates via a method other than the standard login form. Exploitation requires the attacker to possess a valid user account and for the "Enable restriction" setting to be active on the Domain settings page. Users granted the "Login to any domain" permission are not impacted.

Recommendations Update Drupal Domain Login Restrict to a version later than 1.5.0.