The vulnerability is an Authentication Bypass Using an Alternate Path or Channel in Drupal's Domain Login Restrict module. An attacker can exploit a login endpoint or alternate authentication flow that the module does not adequately protect, enabling them to authenticate without valid credentials. This bypass compromises the confidentiality of user accounts and may provide a foothold for further exploitation. The weakness is categorized as CWE‑288, a failure to enforce authentication controls.

All installations of the Domain Login Restrict module with version numbers from 0.0.0 through 1.5.0 are affected. Any Drupal site running the module within that version range, regardless of other security measures, is vulnerable.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, so a specific exploitation probability cannot be quantified. No CVSS score is provided; however, authentication bypass typically allows an attacker to access any user account and potentially administrative functions. The likely attack vector involves submitting HTTP requests to an exposed authentication path on the Drupal instance, requiring only the ability to reach the vulnerable module.