Project machine name:
rest_api_authenticationDate:
2026-September-23
Vulnerability:
Access bypass
Affected versions:
<3.2.0
CVE IDs:
CVE-2026-96385
Description:
This module enables you to add an extra authentication layer to the API.
The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability.
Solution:
Install the latest version:
- Upgrade to REST & JSON API Authentication 3.2.0.
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
Fixed By:
- Drew Webber (mcdruid) of the Drupal Security Team
- purva_shende
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
