The vulnerability identified as CVE-2026-15079 in the Drupal Login Disable module is classified under CWE-307, indicating improper restriction of excessive authentication attempts. This weakness allows an attacker to perform brute force attacks against the authentication mechanism. The affected versions include Login Disable from 0.0.0 through 2.1.4. There is no CVSS score assigned, and no vendor advisory or patch information is currently available. The vulnerability is published and reserved as of July 2026, but remediation status remains unknown.

The vulnerability permits brute force attacks due to insufficient controls on authentication attempts, potentially enabling unauthorized access if exploited. However, there are no reports of active exploitation in the wild. The impact is limited to affected versions of the Login Disable module in Drupal.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider implementing external rate limiting or other brute force protection mechanisms at the network or application level to mitigate risk.