AIKIDO-2026-724533

TL;DR

The Token Content Access module is vulnerable to an authentication bypass due to a timing side-channel in access token comparison. In certain cases, access tokens are not compared using a constant-time operation, allowing an attacker to infer valid token values by measuring response time differences. A successful attack could enable unauthorized access to content protected by the module. Exploitation requires the attacker to know or discover the URL of protected content and perform a sufficient number of timing measurements to recover a valid access token.