The Drupal Login Disable module contains an Improper Restriction of Excessive Authentication Attempts flaw (CWE‑307). Because the module does not enforce rate limiting or lockout policies, an attacker can repeatedly attempt login credentials against any user account. This vulnerability allows brute‑force authentication, leading to potential credential compromise and unauthorized access.

The issue applies to all releases of the Login Disable module from version 0.0.0 up to and including 2.1.4. Any Drupal installation that has one of these module versions installed is vulnerable.

The CVSS score of 5.4 indicates a moderate risk rating, while the EPSS score of < 1% and the lack of inclusion in the CISA KEV catalog suggest that exploitation is currently unlikely. Nonetheless, the vulnerability allows an attacker to perform uncontrolled brute‑force login attempts against Drupal accounts without any rate limiting, making compromise possible if an attacker can guess a correct credential set. Based on the description, it is inferred that the likely attack vector involves accessing the Drupal login endpoint and submitting a large volume of credential guesses from a single or multiple IP addresses.