Live › vulnerability › CVE-2026-96387
Go to dashboardThe Stop administrator login module for Drupal versions 1.0 through 1.6 has an authentication bypass that uses an alternate path or channel to log in. An attacker may be able to reach administrator access without the normal login checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that have the Stop administrator login module installed in the affected version range (1.0 to 1.6). Sites without this module are not affected. The sources do not say whether a default configuration is exposed.
No product ranges from the sources yet.
drush pm:list --filter=stop_admin_login or by reviewing composer show output (unknown module machine name in sources)/admin/modules1.6 (exact fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-96387")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.