Live › vulnerability › CVE-2026-114572
Domain Login Restrict, a Drupal module, has an authentication bypass caused by an alternate path or channel to log in. An attacker may be able to get past the login restriction without valid credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Domain Login Restrict module at version 1.5.0 or earlier. Sites without this module installed are not affected. The sources do not describe the exact configuration needed to trigger the bypass.
No product ranges from the sources yet.
drush pm:list --filter=domain_login_restrict or in the Drupal admin under Extend.0.0.0 to 1.5.0 are affected; move to a version above 1.5.0, the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114572")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.