Is CVE-2026-15079 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15079 being exploited in the wild.

How severe is CVE-2026-15079?

Informational severity, with a CVSS score of 5.4, published 10 July 2026.

Is there a fix for CVE-2026-15079?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable: upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15079 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15079?

Check whether you run Drupal Login Disable or Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15079: Drupal Login Disable brute force vulnerability in secret key protection

CVE-2026-15079 · Severity: info · CVSS 5.4 · Published 2026-07-10

The Login Disable module for Drupal is used to hide the login page behind a secret URL key to prevent unauthorized access. A security flaw allows attackers to repeatedly guess this secret key without being blocked, potentially allowing them to reach the login form. If an attacker successfully guesses the key and possesses valid user credentials, they could bypass the intended security restrictions of the module.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-15079 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15079 being exploited in the wild.
How severe is CVE-2026-15079?: Informational severity, with a CVSS score of 5.4, published 10 July 2026.
Which products and versions are affected?: Drupal Login Disable 0.0.0 to 2.1.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable ECOSYSTEM:introduced=0,fixed=2.1.4.
Is there a fix for CVE-2026-15079?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable: upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15079 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15079?: Check whether you run Drupal Login Disable or Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable: upgrade to 2.1.4 or later

Technical details

The Login Disable module (versions prior to 2.1.4) contains an 'Improper Restriction of Excessive Authentication Attempts' (CWE-307) vulnerability. The module's mechanism for protecting the login form via a secret URL parameter did not implement flood control or rate limiting. This allows a remote attacker to perform a brute-force attack to discover the secret key. While an attacker still requires valid user credentials to log in, discovering the key bypasses the primary access control provided by this module. The vulnerability is resolved in version 2.1.4 by implementing Drupal's flood control API to block excessive attempts.

Affected products

Drupal Login Disable 0.0.0 to 2.1.3

Identifiers

CVE-2026-15079
DRUPAL-CONTRIB-2026-070

Timeline

2026-07-07: patched: Version 2.1.4 released
2026-07-08: advisory: Drupal security advisory SA-CONTRIB-2026-070 published
2026-07-10: disclosed: CVE-2026-15079 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.