Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. (CVE-2026-96387)

CVE-2026-96387 describes an authentication bypass vulnerability in the Drupal Stop administrator login module versions 1.0 to 1.6. The issue allows an attacker with high privileges to bypass authentication by exploiting an alternate path or channel. The vulnerability is classified under CWE-288 (Authentication Bypass). The CVSS v3.1 base score is 3.8, with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, requiring high privileges, no user interaction, unchanged scope, and low confidentiality and integrity impact without availability impact. There is no information about available patches or vendor advisories.

The vulnerability allows an attacker with high privileges to bypass authentication controls, potentially leading to unauthorized access to administrative functions. The impact is limited to low confidentiality and integrity loss, with no availability impact reported. Since exploitation requires high privileges, the risk to systems with properly restricted access is reduced.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected module and monitor for unusual administrative activity. No official fix or workaround information is currently provided.