CVE-2026-122076
CVE-2026-122076 is a vulnerability with no CVSS score yet in drupal/change_pwd_page, published November 4, 2026. No source lists public exploit code. Fixed in drupal/change_pwd_page 2.0.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.3drupal/change_pwd_page
Description
This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one.
The module doesn't sufficiently verify the current password in some cases.
This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/change_pwd_pagePackagist:https://packages.drupal.org/8 | before 2.0.3 | 2.0.3 |
What each source reports
OSVDRUPAL-CONTRIB-2026-307No score
This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one.
The module doesn't sufficiently verify the current password in some cases.
This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover.
- Record
DRUPAL-CONTRIB-2026-307- Updated
- 2026-11-04
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.