CVE-2026-18259

Published: Aug 25, 2026Modified: Aug 25, 2026

Description

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

Related CWEs

CWE-208

Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (1)

https://www.drupal.org/sa-contrib-2026-090

Source: mlhess@drupal.org

Timeline

No history available yet.