PT-2026-84707 · Unknown · Disable Login Page
CVSS v3.1
4.1
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Disable Login Page versions 0.0.0 through 1.1.4
Description
An authentication bypass exists because the module fails to invalidate relevant caches when login page access restrictions are enabled. This allows previously cached responses for the
/user/login endpoint to remain accessible, enabling an attacker to bypass the functionality intended to restrict access to the login page.Recommendations
Clear the system caches after enabling login page access restrictions to ensure that cached responses for the
/user/login endpoint are invalidated.Exploit
Fix
Authentication Bypass Using an Alternate Path or Channel
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Disable Login Page