# CVE-2024-13309: DRUPAL-CONTRIB-2024-073 - This module enables you to prevent existing users from logging in to your Drupal site unless…

Source: https://junglewise.ai/threats/cve-2024-13309-drupal-contrib-2024-073-this-module-enables-you-to-prevent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-11  
License: CC BY 4.0 with a link back

CVE-2024-13309 · Severity: info · Published 2024-12-11

This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page.

The Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass the protection offered by the module.

This vulnerability is mitigated by the fact that an attacker must already have a user account to log in. This bug therefore allows users to log in even if their login is disabled.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable](https://junglewise.ai/threats/technologies/drupal-login-disable). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2024-13309 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-13309 being exploited in the wild.

**How severe is CVE-2024-13309?** Informational severity, published 11 December 2024.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable ECOSYSTEM:introduced=2.0.0,fixed=2.1.1.

**Is there a fix for CVE-2024-13309?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable: upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-13309?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable: upgrade to 2.1.1 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable ECOSYSTEM:introduced=2.0.0,fixed=2.1.1

## Identifiers

- CVE-2024-13309
- DRUPAL-CONTRIB-2024-073

## Related threats

- [Drupal Login Disable brute force vulnerability in secret key protection](https://junglewise.ai/threats/cve-2026-15079-drupal-login-disable-brute-force-vulnerability-in-secret-key)
- [DRUPAL-CONTRIB-2026-008 - The Login Disable module prevents users from logging in to your Drupal site unless they know…](https://junglewise.ai/threats/cve-2026-1917-drupal-contrib-2026-008-the-login-disable-module-prevents-users)