CVE-2026-18260CWE-20CWE-307

CVE-2026-18260

Medium · published August 26, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-08-26T03:16Z
References (2)
https://www.drupal.org/sa-contrib-2026-110 · [email protected]https://www.drupal.org/sa-contrib-2026-110 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 27 AUG 06:20Z
    EPSS moved — → 0%
    epss
  • 25 AUG 22:21Z
    Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091
    cvelistv5