# CVE-2026-76756: Drupal Gammu SMS Daemon timing attack in REST API authentication

Source: https://junglewise.ai/threats/cve-2026-76756-drupal-gammu-sms-daemon-timing-attack-in-rest-api-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76756 · Severity: medium · CVSS 5.9 · Published 2026-09-02

The Drupal Gammu SMS Daemon module provides an interface for sending SMS messages through the Gammu SMS system. A timing vulnerability in the REST API token validation logic could allow an attacker with network proximity to infer the correct authentication token through statistical analysis of response times, potentially gaining unauthorized access to send or view SMS messages.

Technologies: [Drupal Gammu SMS Daemon](https://junglewise.ai/threats/technologies/gammu-sms-daemon). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal).

## Quick answers

**Is CVE-2026-76756 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76756 being exploited in the wild.

**How severe is CVE-2026-76756?** Medium severity, with a CVSS score of 5.9, published 2 September 2026.

**Which products and versions are affected?** Drupal Gammu SMS Daemon 8.x-1.2 and earlier.

**Is there a fix for CVE-2026-76756?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76756 attacked?** It is attacked over the network or from the adjacent network, in a web application.

**Am I affected by CVE-2026-76756?** Check whether you run Drupal Gammu SMS Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a timing-based side-channel attack (CWE-208) in the GammuApiController::send() method, where the API token is compared using a non-timing-safe equality operator (==) rather than a constant-time comparison function. An attacker with adjacency or low-latency network access could perform repeated API calls with guessed tokens and measure response time variations to deduce the correct authentication key byte-by-byte. The attack requires adjacency or other low-latency network positioning and does not require authentication, but successful exploitation requires sufficient time and resources for statistical analysis. A fix using a timing-safe comparison method was committed to the repository on 20 June 2026, and the vulnerability affects all published releases up to 8.x-1.2.

## Affected products

- Drupal Gammu SMS Daemon 8.x-1.2 and earlier

## Timeline

- 2026-05-17: disclosed: Vulnerability reported to maintainer through Drupal's vulnerability reporting service
- 2026-06-20: other: Maintainer committed fix using timing-safe comparison method
- 2026-08-16: advisory: Vulnerability publicly disclosed by researcher
- 2026-08-19: other: CVE-2026-76756 assigned

## References

- [https://www.drupal.org/project/gammu_smsd](https://www.drupal.org/project/gammu_smsd)
- [https://disclosure.cmlara.com/2026/003-Gammu_smsd-TimingAttack/](https://disclosure.cmlara.com/2026/003-Gammu_smsd-TimingAttack/)

## Related threats

- [Drupal Gammu SMS Daemon authorization token disclosure](https://junglewise.ai/threats/cve-2026-76757-drupal-gammu-sms-daemon-authorization-token-disclosure)
- [Drupal Gammu SMS Daemon OS command injection](https://junglewise.ai/threats/cve-2026-76755-drupal-gammu-sms-daemon-os-command-injection)