{"id":"CVE-2026-96387","kind":"vulnerability","aliases":["CVE-2026-96387"],"related":[],"title":"Drupal Stop administrator login module: authentication bypass via alternate path","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.","summary":"The Stop administrator login module for Drupal versions 1.0 through 1.6 has an authentication bypass that uses an alternate path or channel to log in. An attacker may be able to reach administrator access without the normal login checks.","severity":"low","cvss":3.8,"epss":0.00201,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","other","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Stop administrator login module with `drush pm:list --filter=stop_admin_login` or by reviewing `composer show` output (unknown module machine name in sources)\n- Confirm whether the module is enabled on the site at `/admin/modules`","fix":"- Upgrade the Stop administrator login module to a version later than `1.6` (exact fixed version unknown from sources)","status":"open","published_at":"2026-10-22T02:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:43:10+00:00","updated_at":"2026-10-25T04:43:10+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:43:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Stop administrator login module to a version later than `1.6` (exact fixed version unknown from sources)","reach":"internet","title":"Drupal Stop administrator login module: authentication bypass via alternate path","impact":"high","summary":"The Stop administrator login module for Drupal versions 1.0 through 1.6 has an authentication bypass that uses an alternate path or channel to log in. An attacker may be able to reach administrator access without the normal login checks.","category":"other","nicknames":[],"who_cares":["drupal","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker gains administrator login access to the Drupal site","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, the exact module name, and whether the bypass needs a specific setting.","how_to_check":"- Check the installed version of the Stop administrator login module with `drush pm:list --filter=stop_admin_login` or by reviewing `composer show` output (unknown module machine name in sources)\n- Confirm whether the module is enabled on the site at `/admin/modules`","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that have the Stop administrator login module installed in the affected version range (1.0 to 1.6). Sites without this module are not affected. The sources do not say whether a default configuration is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000596,"input_tokens":3336,"output_tokens":525,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96387':13A,16A '1.0':28B,84C '1.6':30B,86C 'abl':49B 'access':53B 'administr':3A,22B,52B,71C,80C 'affect':78C 'allow':73C 'altern':9A,38B,63C 'attack':46B 'authent':6A,33B,59C,74C 'bypass':7A,34B,60C,75C 'channel':41B,66C 'check':58B 'cve':11A,14A 'drupal':1A,17B,26B,69C 'issu':77C 'log':43B 'login':4A,23B,57B,72C,81C 'may':47B 'modul':5A,24B 'normal':56B 'path':10A,39B,64C 'php':19B 'reach':51B 'stop':2A,21B,70C,79C 'use':36B,61C 'version':27B,82C 'via':8A 'vulner':67C 'without':54B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that have the Stop administrator login module installed in the affected version range (1.0 to 1.6). Sites without this module are not affected. The sources do not say whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96387","severity":null,"published_at":"2026-10-22T02:17:08+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96387","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96387","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}