VulnerabilityAwaiting Analysis

CVE-2026-18260

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force.

MEDIUM 5.7EPSS 0.22%

Does this matter?

Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.

Description

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

CVSS 3.1: 5.7 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
EPSS: 0.22% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-307, CWE-20
Source: mlhess@drupal.org

References

https://www.drupal.org/sa-contrib-2026-110
https://www.drupal.org/sa-contrib-2026-110

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.