A critical timing discrepancy vulnerability in the Drupal Token Content Access module permits unauthenticated attackers to conduct brute force attacks against protected resources.

The module suffers from an observable timing discrepancy (CWE-208), which allows an unauthenticated attacker to infer information through response time variations. This mechanism facilitates brute force attempts to bypass content access restrictions.

The ability for unauthenticated parties to perform brute force attacks against content tokens poses a significant risk to data confidentiality. With a CVSS score of 7.5, this high-severity vulnerability could lead to unauthorized access to sensitive information or proprietary content, potentially resulting in data breaches and regulatory non-compliance.

Immediate Action: Review the official Drupal security advisory at https://www.drupal.org/sa-contrib-2026-090 and apply the latest available update for the Token Content Access module.

Proactive Monitoring: Monitor server access logs for anomalous patterns of repeated requests or spikes in traffic targeting token-based endpoints, which may indicate active brute force attempts.

Compensating Controls: Implement rate limiting at the Web Application Firewall (WAF) level to throttle requests to the affected module and block IP addresses exhibiting suspicious brute force behavior.

Public Exploit Available: No

The high CVSS score and the nature of the vulnerability necessitate immediate attention, especially for deployments protecting sensitive data. Administrators should prioritize updating the Token Content Access module to the latest version to resolve the timing discrepancy and eliminate the brute force vector. If an immediate update is not feasible, restrict access to the affected endpoints using network-level controls until a patch can be applied.