Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. (CVE-2026-16647)

This vulnerability in the Drupal Disable Login Page module (versions 0.0.0 to 1.1.4) allows an attacker with high privileges to bypass authentication mechanisms by using an alternate path or channel, resulting in functionality bypass. The issue is classified under CWE-288 (Authentication Bypass). The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality impact.

An attacker with high privileges can bypass authentication controls in the affected module, potentially allowing unauthorized access to functionality that should be restricted. The confidentiality impact is low, and there is no impact on integrity or availability. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the module and consider disabling it if feasible.