CVE-2013-2198: The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to...

Security readout for executives and security teams

This issue affects the Drupal Login Security module, not Drupal core. Older 6.x and 7.x module releases may let an attacker get around login restrictions by using a specially crafted username. Business risk depends on whether the module protects important accounts and whether affected versions remain deployed. Likely exposure is limited to Drupal sites that installed and enabled the Login Security module in affected 6.x-1.x or 7.x-1.x versions. Sites without this contributed module, or already on 1.3 or later, are not indicated as affected by the provided sources. Treat this as a targeted hygiene item for legacy Drupal estates. Prioritize internet-facing or business-critical Drupal sites that rely on Login Security for account protection, but do not escalate as actively exploited based on the provided evidence. Mitigation focus: Upgrade Login Security to 6.x-1.3, 7.x-1.3, or a later supported release.; Review the linked Drupal advisory pages for module-specific guidance.; Inventory Drupal sites for the Login Security module and installed version..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.