Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Date:
2024-May-29
Vulnerability:
Access bypass
Affected versions:
<2.0.13
CVE IDs:
CVE-2024-13258
Description:
Drupal REST & JSON API Authentication module restricts and secures unauthorized access to your Drupal site APIs using different authentication methods including Basic Authentication , API Key Authentication , JWT Authentication , OAuth Authentication , External / Third-Party Provider Authentication, etc.
The module doesn't sufficiently control user access when using Basic Authentication.
Solution:
Install the latest version:
- If you use the 2.0.x branch, upgrade to Drupal REST & JSON API Authentication 2.0.13
- If you use the 8.x-1.x branch, upgrade to Drupal REST & JSON API Authentication 2.0.13, as the 8.x-1.x branch is now unsupported.
Reported By:
Fixed By:
- solideogloria
- Shashank Thigale
- Arek Suchecki
- Greg Knaddison of the Drupal Security Team
Coordinated By:
- Greg Knaddison of the Drupal Security Team
- Juraj Nemec of the Drupal Security Team
- David Rothstein of the Drupal Security Team
- Michael Hess of the Drupal Security Team
