Project: 
Automated Logout
Date: 
2026-March-18
Security risk: 
Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All
Vulnerability: 
Cross-site request forgery
Affected versions: 
<1.7.0 || >=2.0.0 <2.0.2
CVE IDs: 
CVE-2026-4393
Description: 

This module provides a site administrator the ability to log users out after a specified time of inactivity.

The module doesn't sufficiently protect its routes from cross-site request forgery (CSRF), allowing the logout route to be triggered without user interaction.

Solution: 

Install the latest version:

  • If you use Automated Logout 8.x-1.x version 8.x-1.6 or lower, upgrade to autologout 8.x-1.7.
  • If you use Automated Logout 2.x version 2.0.1 or lower, upgrade to autologout 2.0.2.
Reported By: 
Fixed By: 
Coordinated By: