Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3.

A successful CSRF attack can lead to an attacker performing actions as the logged-in user without their knowledge or consent. In the context of the Drupal Login Time Restriction module, this could allow an attacker to modify login time restrictions, potentially granting unauthorized access or bypassing security controls. The impact is amplified if the affected Drupal site handles sensitive data or critical operations. While the specific impact depends on the configuration of the Login Time Restriction module, the potential for unauthorized modifications makes this a significant security concern. CSRF vulnerabilities are often exploited through phishing emails or malicious websites designed to mimic legitimate Drupal interfaces.

Drupal sites utilizing the Login Time Restriction module, particularly those with sensitive data or critical functionality, are at risk. Sites running older, unpatched versions of Drupal are especially vulnerable. Shared hosting environments where users have limited control over installed modules also face increased risk.

• drupal: Check the version of the Login Time Restriction module using drush pm-info logintimerestriction. If the version is less than 1.0.3, the system is vulnerable. • generic web: Monitor Drupal site logs for suspicious POST requests originating from different IP addresses than the authenticated user's. Use a WAF to block requests without valid CSRF tokens.

1. 2026-01-28Disclosure

   disclosure

1. Reserviert2025-12-03
2. Veröffentlicht2026-01-28
3. Geändert2026-02-19
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-13982 is to upgrade the Drupal Login Time Restriction module to version 1.0.3 or later. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing CSRF tokens on critical forms within the Login Time Restriction module. While not a complete solution, this can provide an additional layer of protection. Review Drupal's general CSRF prevention mechanisms and ensure they are properly configured. Monitor Drupal logs for suspicious activity, particularly requests originating from unexpected sources.