View online: https://www.drupal.org/sa-contrib-2026-307 Project: Password Separate Form [1] Project machine name: change_pwd_page Date: 2026-November-04 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-122076 Description: This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one. The module doesn't sufficiently verify the current password in some cases. This vulnerability is mitigated by the fact that an attacker must already have access to the victim's authenticated session (for example an unattended browser or a stolen session cookie). It allows that temporary session access to be turned into a persistent account takeover. Solution: Install the latest version: * If you use version 2.0.x, upgrade to Password Separate Form 2.0.3 [3]. Reported By: * Motoki Kobayashi (otofu) [4] Fixed By: * Steven Ayers (bluegeek9) [5] * Motoki Kobayashi (otofu) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/change_pwd_page [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/change_pwd_page/releases/2.0.3 [4] https://www.drupal.org/u/otofu [5] https://www.drupal.org/u/bluegeek9 [6] https://www.drupal.org/u/otofu [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....