[IT-SecNots] [Security-news] Password Separate Form - Moderately critical - Access bypass - SA-CONTRIB-2026-307

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-307

Project: Password Separate Form [1]
Project machine name: change_pwd_page
Date: 2026-November-04
Security risk: *Moderately critical* 10 ∕ 25
AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Affected versions: <2.0.3
CVE IDs: CVE-2026-122076
Description: 
This module provides a separate page with a form for users to change their
own password, which asks for the current password before accepting a new one.

The module doesn't sufficiently verify the current password in some cases.

This vulnerability is mitigated by the fact that an attacker must already
have access to the victim's authenticated session (for example an unattended
browser or a stolen session cookie). It allows that temporary session access
to be turned into a persistent account takeover.

Solution: 
Install the latest version:

 * If you use version 2.0.x, upgrade to Password Separate Form 2.0.3 [3].

Reported By: 
 * Motoki Kobayashi (otofu) [4]

Fixed By: 
 * Steven Ayers (bluegeek9) [5]
 * Motoki Kobayashi (otofu) [6]

Coordinated By: 
 * Swan Kalata (akalata) [7] of the Drupal Security Team
 * Greg Knaddison (greggles) [8] of the Drupal Security Team
 * Drew Webber (mcdruid) [9] of the Drupal Security Team
 * Jess  (xjm) [10] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [11]

[1] https://www.drupal.org/project/change_pwd_page
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/change_pwd_page/releases/2.0.3
[4] https://www.drupal.org/u/otofu
[5] https://www.drupal.org/u/bluegeek9
[6] https://www.drupal.org/u/otofu
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/mcdruid
[10] https://www.drupal.org/u/xjm
[11]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3633292

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at