EUVD-2026-66200
GHSA-prxm-c7p3-5gv7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H applied because successful timing extraction depends on network latency conditions beyond attacker control; no integrity or availability impact exists.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
AnalysisAI
Observable timing discrepancy in the Drupal Token Content Access module exposes token-protected content to brute-force enumeration via side-channel analysis. All module versions from 0.0.0 through 3.1.2 are affected; unauthenticated remote attackers (PR:N, AV:N per CVSS) can measure differential response times during token validation to reconstruct valid access tokens character-by-character, ultimately bypassing content access restrictions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Token Content Access Drupal module must be installed and actively configured to restrict one or more content items using token-based access control - this is the module's core use case, so any standard deployment is affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is arguably generous in setting AC:L, since timing attacks against network services depend on environmental conditions - particularly round-trip latency variance - that are outside the attacker's direct control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Token Content Access module to version 3.1.2 or later, as detailed in Drupal Security Advisory SA-CONTRIB-2026-090 (https://www.drupal.org/sa-contrib-2026-090); this is the primary and preferred remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Drupal installations using the Token Content Access module and inventory their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today