The Drupal Login Disable module contains an improper restriction of excessive authentication attempts vulnerability (CWE-307) that allows attackers to perform brute force attacks. This affects versions from 0.0.0 through 2.1.4 of the module. The vulnerability permits repeated login attempts without adequate throttling or lockout mechanisms, increasing the risk of credential guessing. The CVSS 3.1 base score is 5.4, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality and integrity with no impact on availability. No vendor advisory or patch information is currently available.

An attacker with network access and low privileges can attempt multiple authentication attempts without effective restriction, potentially leading to unauthorized access through brute force. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing external rate limiting or account lockout policies at the infrastructure level to mitigate brute force risks. Monitor authentication attempts for unusual activity. Avoid relying solely on the vulnerable module's controls.