An attacker can bypass authentication by using an alternate path or channel within Drupal Stop administrator login. This bypass allows the attacker to log in as an administrator without providing valid credentials. Classified as CWE-288, indicating improper authorization, the vulnerability would grant an attacker full control over the affected site if successfully exploited.

The Drupal Stop administrator login module in versions 1.0 through 1.6 is vulnerable. Any Drupal installation using these versions of the module is at risk.

The CVSS score is 3.5, indicating moderate severity. EPSS is < 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can perform the bypass by accessing an alternate path or channel presented by the module; the network exposure is not defined, so the attack could originate from local or remote sources. Without mitigation, the risk of exploitation remains significant.