# CVE-2026-15079: Drupal Login Disable brute force vulnerability in secret key protection

Source: https://junglewise.ai/threats/cve-2026-15079-drupal-login-disable-brute-force-vulnerability-in-secret-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-15079 · Severity: info · CVSS 5.4 · Published 2026-07-10

The Login Disable module for Drupal is used to hide the login page behind a secret URL key to prevent unauthorized access. A security flaw allows attackers to repeatedly guess this secret key without being blocked, potentially allowing them to reach the login form. If an attacker successfully guesses the key and possesses valid user credentials, they could bypass the intended security restrictions of the module.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable](https://junglewise.ai/threats/technologies/drupal-login-disable). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-15079 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15079 being exploited in the wild.

**How severe is CVE-2026-15079?** Informational severity, with a CVSS score of 5.4, published 10 July 2026.

**Which products and versions are affected?** Drupal Login Disable 0.0.0 to 2.1.3; Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable ECOSYSTEM:introduced=0,fixed=2.1.4.

**Is there a fix for CVE-2026-15079?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable: upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15079 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15079?** Check whether you run Drupal Login Disable or Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Login Disable: upgrade to 2.1.4 or later

## Technical details

The Login Disable module (versions prior to 2.1.4) contains an 'Improper Restriction of Excessive Authentication Attempts' (CWE-307) vulnerability. The module's mechanism for protecting the login form via a secret URL parameter did not implement flood control or rate limiting. This allows a remote attacker to perform a brute-force attack to discover the secret key. While an attacker still requires valid user credentials to log in, discovering the key bypasses the primary access control provided by this module. The vulnerability is resolved in version 2.1.4 by implementing Drupal's flood control API to block excessive attempts.

## Affected products

- Drupal Login Disable 0.0.0 to 2.1.3

## Identifiers

- CVE-2026-15079
- DRUPAL-CONTRIB-2026-070

## Timeline

- 2026-07-07: patched: Version 2.1.4 released
- 2026-07-08: advisory: Drupal security advisory SA-CONTRIB-2026-070 published
- 2026-07-10: disclosed: CVE-2026-15079 published to NVD

## References

- [https://www.drupal.org/project/login_disable](https://www.drupal.org/project/login_disable)
- [https://www.drupal.org/sa-contrib-2026-070](https://www.drupal.org/sa-contrib-2026-070)

## Related threats

- [DRUPAL-CONTRIB-2026-008 - The Login Disable module prevents users from logging in to your Drupal site unless they know…](https://junglewise.ai/threats/cve-2026-1917-drupal-contrib-2026-008-the-login-disable-module-prevents-users)
- [DRUPAL-CONTRIB-2024-073 - This module enables you to prevent existing users from logging in to your Drupal site unless…](https://junglewise.ai/threats/cve-2024-13309-drupal-contrib-2024-073-this-module-enables-you-to-prevent)