CVE-2026-18259

Awaiting Analysis Awaiting Analysis - Queue

Observable Timing Discrepancy in Drupal Token Content Access Allows Brute Force

Publication date: 2026-08-25

Last updated on: 2026-08-28

Assigner: Drupal.org

Description

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-18259

EUVD

EUVD-2026-66200

Affected Vendors & Products

Vendor	Product	Version / Range
drupal	token_content_access	From 0.0.0 (inc) to 3.1.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability is an Observable Timing Discrepancy in Drupal Token Content Access that allows brute force attacks. It affects versions 0.0.0 to 3.1.2 of the module.

Impact Analysis

An attacker could exploit timing differences to guess valid tokens or credentials, potentially gaining unauthorized access to sensitive content or functionality.

Mitigation Strategies

Update Token Content Access to version 3.1.3 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-18259. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70