The Login Disable module for Drupal allows an attacker to bypass the normal login process by using an alternate route or channel within the module’s functionality. This flaw, classified as CWE‑288, can grant unauthorized users access to areas of a Drupal site that normally require valid credentials, potentially enabling information disclosure or administrative actions.

Drupal sites running the Login Disable module from initial release up through version 2.1.2 are affected. Versions 2.1.3 and later contain the fix. The affected module is identified by its CPE designation but is typically referenced as the Login Disable module in Drupal installations.

The CVSS score of 4.3 indicates a low-to‑moderate severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to target a site that has the vulnerable module installed and exploit the alternate authentication path. No evidence exists that exploitation requires privileged access or knowledge beyond the public web root.