Live › vulnerability › CVE-2026-96385
Go to dashboardThe REST & JSON API Authentication module for Drupal has an authentication bypass through an alternate path or channel. An attacker can reach protected API resources without valid credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that use the REST & JSON API Authentication module for API authentication, with versions from 0.0.0 through 3.2.0, are affected. Sites that do not install this module, or that do not expose its endpoints, can likely skip it.
No product ranges from the sources yet.
composer show drupal/rest_json_api_auth or the module's info file, and see whether it is 3.2.0 or older.3.2.0; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-96385")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.