Executive brief
The Drupal Gammu SMS Daemon module provides an interface for sending SMS messages through the Gammu SMS system. A timing vulnerability in the REST API token validation logic could allow an attacker with network proximity to infer the correct authentication token through statistical analysis of response times, potentially gaining unauthorized access to send or view SMS messages.
Technical details
The vulnerability is a timing-based side-channel attack (CWE-208) in the GammuApiController::send() method, where the API token is compared using a non-timing-safe equality operator (==) rather than a constant-time comparison function. An attacker with adjacency or low-latency network access could perform repeated API calls with guessed tokens and measure response time variations to deduce the correct authentication key byte-by-byte. The attack requires adjacency or other low-latency network positioning and does not require authentication, but successful exploitation requires sufficient time and resources for statistical analysis. A fix using a timing-safe comparison method was committed to the repository on 20 June 2026, and the vulnerability affects all published releases up to 8.x-1.2.
Affected products
- Drupal Gammu SMS Daemon 8.x-1.2 and earlier
Timeline
- 2026-05-17: disclosed: Vulnerability reported to maintainer through Drupal's vulnerability reporting service
- 2026-06-20: other: Maintainer committed fix using timing-safe comparison method
- 2026-08-16: advisory: Vulnerability publicly disclosed by researcher
- 2026-08-19: other: CVE-2026-76756 assigned