CVE-2026-16647: CWE-288 Authentication Bypass Using an Alternate Path or Channel in Drupal Disable Login Page

This vulnerability in the Drupal Disable Login Page module (versions 0.0.0 to 1.1.4) allows an attacker with high privileges to bypass authentication controls by using an alternate path or channel, resulting in functionality bypass. The issue is categorized as CWE-288. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality impact. No known exploits are reported in the wild and no official fix or patch has been published as of the data provided.

An attacker with high privileges could bypass authentication mechanisms in the Disable Login Page module, potentially gaining unauthorized access to functionality that should be restricted. The impact on confidentiality is low, and there is no impact on integrity or availability. This could allow circumvention of intended access controls within Drupal sites using this module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor Drupal security advisories for updates. Until a fix is released, consider restricting access to the affected module or disabling it if feasible.