CVE-2026-18260: Drupal Disable Login Page

Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

Affected products

• Drupal Disable Login Page: from 0.0.0, before 1.1.4 (fixed in 1.1.4)

Published 2026-08-25. Last modified 2026-09-02.