Is CVE-2026-18260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18260 being exploited in the wild.

How severe is CVE-2026-18260?

Medium severity, with a CVSS score of 5.7, published 25 August 2026.

Which products and versions are affected?

Packagist:Https://Packages.Drupal.Org/8 Drupal/Disable Login ECOSYSTEM:introduced=0,fixed=1.1.4.

Is there a fix for CVE-2026-18260?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Disable Login: upgrade to 1.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18260 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-18260?

Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Disable Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18260: Drupal Disable Login Page brute force attack on secret key

CVE-2026-18260 · Severity: medium · CVSS 5.7 · Published 2026-08-25

The Disable Login Page module is a Drupal security extension that restricts access to the login form by requiring a secret key. The module fails to limit repeated login attempts, allowing attackers to brute force the secret key and gain unauthorized access to the login page on affected sites.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Disable Login. Vendors: Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-18260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18260 being exploited in the wild.
How severe is CVE-2026-18260?: Medium severity, with a CVSS score of 5.7, published 25 August 2026.
Which products and versions are affected?: Packagist:Https://Packages.Drupal.Org/8 Drupal/Disable Login ECOSYSTEM:introduced=0,fixed=1.1.4.
Is there a fix for CVE-2026-18260?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Disable Login: upgrade to 1.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18260 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-18260?: Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Disable Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Disable Login: upgrade to 1.1.4 or later

Technical details

This is a brute force vulnerability (CWE-307: Improper Restriction of Excessive Authentication Attempts) in the Disable Login Page module's access control mechanism. The module protects /user/login with a query string parameter containing a secret key-value pair, but lacks rate limiting or attempt restrictions. An unauthenticated attacker on the network can repeatedly guess the key without throttling, allowing brute force enumeration of valid keys. The vulnerability affects versions prior to 1.1.4, and was patched in version 1.1.4 released 2026-08-26.

Affected products

Drupal Disable Login Page before 1.1.4

Identifiers

CVE-2026-18260
DRUPAL-CONTRIB-2026-091
DRUPAL-CONTRIB-2026-110

Timeline

2026-08-26: disclosed
2026-08-26: patched: Version 1.1.4 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.