Description

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-25T23:16:57.600Z",
  "pubdate": "2026-08-25T23:16:57.600Z",
  "executiveSummary": "The Token Content Access module for Drupal is susceptible to an observable timing discrepancy vulnerability, classified as a side-channel attack vector.\nThis vulnerability allows an unauthenticated or low-privileged attacker to perform brute-force operations against sensitive tokens by measuring the time taken for the server to process access requests.\nThe issue affects all versions of Token Content Access from 0.0.0 through 3.1.2.\nThe primary impact is the unauthorized enumeration and validation of restricted content tokens, potentially leading to unauthorized data disclosure if valid tokens are successfully brute-forced.\nThe vulnerability originates from the implementation of string comparison operations during the validation of token-based access requests, which do not execute in constant time.\nAttackers can exploit this by sending a sequence of requests with varying payloads and observing the execution time latency, which correlates with the length or accuracy of the provided token segment.\nNo specific authentication is required to initiate these timing measurements, and the attack can be performed remotely over a network.\nThe security risk is categorized as moderate to high, depending on the sensitivity of the data protected by the tokens.",
  "technicalDetails": "The vulnerability is rooted in the use of non-constant-time string comparison functions when verifying token-based access requests within the Token Content Access module. When the application compares a user-supplied token against a stored or expected value, it utilizes a standard comparison operator that terminates immediately upon encountering the first differing byte.\nThis behavior results in a measurable timing discrepancy: comparisons that match the initial characters of the valid token take slightly longer to execute than those that fail on the first character. By systematically iterating through possible character combinations for the token, an attacker can statistically analyze the response times to confirm the validity of individual characters one by one.\nThe attack flow follows a side-channel measurement methodology. An attacker sends a large volume of requests to the vulnerable endpoint while measuring the time taken by the server to return an 'access denied' response. The attacker measures the 'Request-Response' latency with high precision. Even small variances in CPU execution time are amplified over repeated samples, effectively filtering out network noise to reveal the underlying computational time differences.\nBy observing these discrepancies, the attacker can determine the correct character at each position of the token string. Once a character is correctly identified, the attacker proceeds to the next position, significantly reducing the keyspace required for a brute-force attack compared to a standard blind search. This effectively bypasses traditional rate-limiting mechanisms that might be in place for invalid requests, as the attacker is essentially performing an oracle-based discovery.\nThis vulnerability exists in versions 0.0.0 up to and including 3.1.2 of the Token Content Access module. It affects the core logic responsible for evaluating token authorization. The exploitation does not require prior knowledge of the target system's internal architecture, and it can be conducted over standard HTTP/HTTPS protocols. Because the comparison happens during the initial validation phase, successful exploitation allows the attacker to gain unauthorized access to protected resources by crafting a valid token that bypasses existing authorization controls.\nPost-exploitation, the attacker is granted access to the specific resources or content intended to be hidden behind the token-based security mechanism, resulting in potential information leakage and a compromise of the site's access control policy."
}