CVE-2026-16647

Name of the Vulnerable Software and Affected Versions Disable Login Page versions 0.0.0 through 1.1.4

Description An authentication bypass exists because the module fails to invalidate relevant caches when login page access restrictions are enabled. This allows previously cached responses for the /user/login endpoint to remain accessible, enabling an attacker to bypass the functionality intended to restrict access to the login page.

Recommendations Clear the system caches after enabling login page access restrictions to ensure that cached responses for the /user/login endpoint are invalidated.