Gareth Alexander

**Name of the Vulnerable Software and Affected Versions** Drupal Automated Logout versions 0.0.0 through 1.6.9 Drupal Automated Logout versions 2.0.0 through 2.0.1 **Description** The Automated Logout module for Drupal does not adequately protect its routes against Cross-Site Request Forgery (CSRF). This allows an attacker to trigger the logout route without the user’s knowledge or consent. The module is designed to allow site administrators to log users out after a period of inactivity. **Recommendations** Update Drupal Automated Logout to version 1.7.0 or later. Update Drupal Automated Logout to version 2.0.2 or later.