CVE-2026-122076: Composer/drupal/change_pwd_page vulnerability
This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one.
The module doesn't sufficiently verify the current password in some cases.
This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/change_pwd_pageto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users whose authenticated sessions can be accessed by an attacker are exposed. Examples given include an unattended browser or a stolen session cookie.
What must an attacker have to exploit the vulnerability?
The attacker must already have access to the victim's authenticated session. The issue can then allow that temporary access to be converted into persistent control of the account.
How can a team tell whether an account may already have been affected?
The provided information does not describe specific indicators or logs. A practical concern would be accounts where an attacker may have obtained an authenticated session and subsequently changed the account password.