CVE-2026-18260

Ein Angreifer kann mehrere Schwachstellen in Drupal (Token Content Access, Disable Login Page und Powerful Surveys) ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um nicht näher spezifizierte Auswirkungen zu verursachen.

An advisory for this issue has been issued at <https://www.drupal.org/sa-contrib-2026-110> and an additional issue was identified and fixed via <https://www.drupal.org/sa-contrib-2026-111> This module is now resupported. See that advisory for more details. *Original content* The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-maintainer-of-a-project-that-is-unsupported-for-security-reasons)

This module enables you to disable access to the `/user/login` form unless a secret key is provided. The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism.