CVE-2026-15079

Name of the Vulnerable Software and Affected Versions Drupal Login Disable versions 0.0.0 through 2.1.4

Description The Login Disable module, which restricts site access by requiring a secret key on the login form, does not sufficiently protect the form from brute force attacks. An attacker could potentially bypass this protection by guessing the secret key, depending on its length. This issue is partially mitigated because the attacker still requires a valid username and password to gain access.

Recommendations Update Drupal Login Disable to a version newer than 2.1.4 to enable flood control that blocks excessive authentication attempts.