The Automated Logout module for Drupal does not adequately protect its routes against Cross-Site Request Forgery (CSRF). This allows an attacker to trigger the logout route without the user’s knowledge or consent. The module is designed to allow site administrators to log users out after a period of inactivity.