Executive brief
Token Content Access is a Drupal module that protects sensitive content using URL-based access tokens. A timing-based vulnerability allows attackers to guess valid tokens through repeated requests, bypassing access restrictions even though they must first know or discover the protected URL.
Technical details
The module fails to implement constant-time comparison when validating access tokens, enabling a timing attack vulnerability. An attacker who knows or discovers a protected URL can measure response time differences across multiple token guesses to infer whether characters are correct, gradually reconstructing a valid token. The vulnerability affects all versions prior to 3.1.2 and requires network access and the ability to measure timing variations in responses. Exploitation is practical but requires sophisticated timing measurement. A patch was released as Token Content Access 3.1.2.
Affected products
- Drupal Token Content Access 0.0.0 to 3.1.2
Timeline
- 2026-07-29: disclosed
- 2026-07-31: patched: Version 3.1.2 released
- 2026-08-25: advisory