{"id":"CVE-2026-96385","kind":"vulnerability","aliases":["CVE-2026-96385"],"related":[],"title":"Drupal REST & JSON API Authentication: authentication bypass via alternate channel","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.","summary":"The REST & JSON API Authentication module for Drupal has an authentication bypass through an alternate path or channel. An attacker can reach protected API resources without valid credentials.","severity":"medium","cvss":6.5,"epss":0.0021,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the REST & JSON API Authentication module, e.g. `composer show drupal/rest_json_api_auth` or the module's info file, and see whether it is `3.2.0` or older.\n- Review whether the site exposes JSON API or REST endpoints that rely on this module for authentication.","fix":"- Upgrade the REST & JSON API Authentication module to a version later than `3.2.0`; the exact fixed version is unknown from the sources.\n- Until upgraded, restrict access to the affected REST and JSON API endpoints at the web server or firewall.","status":"open","published_at":"2026-10-22T02:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:48:38+00:00","updated_at":"2026-10-25T03:48:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:48:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the REST & JSON API Authentication module to a version later than `3.2.0`; the exact fixed version is unknown from the sources.\n- Until upgraded, restrict access to the affected REST and JSON API endpoints at the web server or firewall.","reach":"internet","title":"Drupal REST & JSON API Authentication: authentication bypass via alternate channel","impact":"medium","summary":"The REST & JSON API Authentication module for Drupal has an authentication bypass through an alternate path or channel. An attacker can reach protected API resources without valid credentials.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker bypasses API authentication and reads or changes protected data.","analyst_note":"Check the NVD entry and Drupal security advisory for the fixed version, exact affected endpoints, and whether exploitation requires special configuration.","how_to_check":"- Check the installed version of the REST & JSON API Authentication module, e.g. `composer show drupal/rest_json_api_auth` or the module's info file, and see whether it is `3.2.0` or older.\n- Review whether the site exposes JSON API or REST endpoints that rely on this module for authentication.","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that use the REST & JSON API Authentication module for API authentication, with versions from 0.0.0 through 3.2.0, are affected. Sites that do not install this module, or that do not expose its endpoints, can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3362,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96385':13A,16A '0.0.0':82C '3.2.0':84C 'affect':73C 'allow':68C 'altern':9A,37B,55C 'api':4A,26B,46B,64C,76C 'attack':42B 'authent':5A,6A,27B,33B,51C,65C,69C,77C 'bypass':7A,34B,52C,70C 'channel':10A,40B,58C 'credenti':50B 'cve':11A,14A 'drupal':1A,17B,30B,61C,67C,79C 'host':22B 'issu':72C 'json':3A,25B,63C,75C 'modul':28B 'packag':18B 'path':38B,56C 'php':19B 'protect':45B 'reach':44B 'resourc':47B 'rest':2A,24B,62C,74C 'self':21B 'self-host':20B 'use':53C 'valid':49B 'version':80C 'via':8A 'vulner':59C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that use the REST & JSON API Authentication module for API authentication, with versions from 0.0.0 through 3.2.0, are affected. Sites that do not install this module, or that do not expose its endpoints, can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96385","severity":null,"published_at":"2026-10-22T02:17:08+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96385","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96385","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}