CVE-2026-16647CWE-288

CVE-2026-16647

Medium · published September 2, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.0th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-09-02T17:17Z
Affected products (1)
ProductVersionsFixed in
zyxware/disable_login_page< 1.1.41.1.4
References (1)
https://www.drupal.org/sa-contrib-2026-111 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:38Z
    EPSS moved — → 0%
    epss
  • 02 SEP 12:55Z
    Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
    cvelistv5