CVE-2025-13982: Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-28 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3.

Affected products

Drupal Login Time Restriction: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Drupal Login Time Restriction 1.0.3. Check the vendor advisory for mitigations.

References

https://www.drupal.org/sa-contrib-2025-120

Get alerted when CVE-2025-13982 or the next vulnerability affects your stack