CVE-2026-114572 in Domain Login Restrict Plugin
Summary
by MITRE • 10/30/2026
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Domain Login Restrict module for the Drupal content management system contains a critical authentication bypass flaw that stems from an improper validation of access control rules when users attempt to log in through alternative or non-standard pathways within the application architecture. This vulnerability, classified under CWE-287 as Improper Authentication, allows attackers to circumvent intended security restrictions by exploiting inconsistencies between different entry points for user verification. The module is designed to restrict login attempts based on specific domain criteria, yet it fails to consistently enforce these constraints across all authentication channels available in the Drupal framework.
In a typical secure implementation, any attempt to authenticate a user must pass through a centralized and rigorously validated mechanism that checks credentials against defined policies without exception. However, in versions of Domain Login Restrict ranging from 0.0.0 up to 1.5.0, there exists a logical gap where certain API endpoints or alternative login forms do not invoke the same domain restriction logic as the primary user interface. An attacker can identify these alternate paths and submit authentication requests that bypass the domain-based filtering rules entirely. This allows unauthorized users with valid credentials for other domains to gain access to resources intended only for specific restricted groups, effectively nullifying the security boundary established by the module's configuration.
The operational impact of this vulnerability is severe as it undermines the fundamental principle of least privilege and data isolation within multi-domain Drupal installations. Organizations relying on Domain Login Restrict to segregate user bases or enforce strict access controls may find that sensitive information becomes accessible to unauthorized entities. This can lead to data breaches, compliance violations under standards such as GDPR or HIPAA if protected health or personal data is exposed, and potential further exploitation through privilege escalation attacks once initial access is gained. The flaw aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts, where adversaries use legitimate credentials obtained from various sources to bypass security controls that rely on identity verification rather than just credential validity.
Mitigation strategies must prioritize immediate remediation by upgrading the Domain Login Restrict module to a version greater than 1.5.0, which addresses this logical inconsistency in authentication flow validation. Until an update is applied, administrators should implement compensating controls such as web application firewall rules that monitor for anomalous login patterns originating from unexpected endpoints or paths. Additionally, enforcing multi-factor authentication adds a layer of security that can mitigate the risk even if credential-based bypass occurs. Regular audits of custom code and third-party modules are essential to ensure no other alternate channels exist that could be exploited in similar manners, ensuring comprehensive coverage against alternative path attacks across the entire application surface area.