Visit Drupal NES Home Page
Login Disable Release Notes
1 version
Comprehensive release notes and changelog for Login Disable, including security patches, bug fixes, and feature updates across all supported versions.
July 2026
7.1.3
Released Jul 21, 2026 Full Version:
7.1.3+7.1.2:login_disable
Notes
This is the initial NES release of the Login Disable module.
Changes
- Security: Fix an access bypass (CVE-2026-1917) where, when login was disabled with an access key configured, a non-form login endpoint could complete login through Drupal's normal login finalization flow and bypass the module's access-key check entirely.
- Security: Enforce the access-key requirement in
hook_user_login()so it applies to non-form login routes, not just the login form. - Testing: Add SimpleTest coverage for form and non-form login, with and without the access key.
Stay in the loop
~/herodevs-spring-framework-support
herodevs@nes:open-source$ ./display-support-info.sh