DRUPAL-CONTRIB-2026-307: Composer/drupal/change_pwd_page vulnerability
This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one.
The module doesn't sufficiently verify the current password in some cases.
This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/change_pwd_pageto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of composer/drupal/change_pwd_page are exposed when an attacker can access a victim's authenticated session, such as through an unattended browser or a stolen session cookie. The issue can convert that temporary session access into persistent control of the victim's account.
What does an attacker need to exploit this vulnerability?
The attacker must already have access to the victim's authenticated session. The provided information does not indicate that unauthenticated attackers can exploit it.
How can we tell whether an account may have been affected?
Review whether an account's password was changed during a period in which its authenticated session may have been accessible to someone else, such as on an unattended browser or after suspected session-cookie theft. The available information does not provide a more specific detection method.