CVE-2025-13982: CSRF in Drupal Login Time Restriction

A successful CSRF attack can lead to an attacker performing actions as the logged-in user without their knowledge or consent. In the context of the Drupal Login Time Restriction module, this could involve manipulating login time restrictions, potentially granting unauthorized access or bypassing security measures. The impact is heightened if the affected Drupal site handles sensitive data or performs critical operations. While the specific impact depends on the configuration and usage of the Login Time Restriction module, the potential for unauthorized actions warrants immediate attention. This vulnerability is similar to other CSRF vulnerabilities in Drupal modules, where improper input validation and lack of CSRF tokens can be exploited.

1. Reserved2025-12-03
2. Published2026-01-28
3. Modified2026-02-19
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-13982 is to upgrade the Drupal Login Time Restriction module to version 1.0.3 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as carefully reviewing and validating all user inputs, particularly those related to login time restrictions. Implementing robust CSRF token protection mechanisms throughout the Drupal site is also crucial. Ensure that all forms and sensitive actions require a valid CSRF token to prevent unauthorized requests. After upgrading, confirm the fix by attempting a CSRF attack on a test environment to verify that the protection is effective.