CVE-2026-122067
The REST & JSON API Authentication module provides API authentication for Drupal sites.
The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.
What each source reports
OSVDRUPAL-CONTRIB-2026-298 No score
The REST & JSON API Authentication module provides API authentication for Drupal sites.
The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.
- Record
DRUPAL-CONTRIB-2026-298- Updated
- 2026-11-04
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/rest_api_authenticationPackagist:https://packages.drupal.org/8 |
before 3.2.1 | 3.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-122067 is a vulnerability with no CVSS score yet in drupal/rest_api_authentication, published November 4, 2026. No source lists public exploit code. Fixed in drupal/rest_api_authentication 3.2.1.