{"id":"CVE-2026-96385","aliases":["DRUPAL-CONTRIB-2026-182","EUVD-2026-107819","GHSA-777p-gg7f-p2jf"],"status":"published","title":"REST \u0026 JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST \u0026 JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST \u0026 JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00279,"percentile":0.20497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288"],"published":"2026-09-23T17:10:00Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/rest_api_authentication","fixed_in":["3.2.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/rest_api_authentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]}],"products":[{"vendor":"drupal","product":"rest \u0026 json api authentication for drupal"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-182","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96385","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-777p-gg7f-p2jf"},{"url":"https://git.drupalcode.org/project/rest_api_authentication","tags":["web"]},{"url":"https://www.drupal.org/project/rest_api_authentication","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96385.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-96385","title":"REST \u0026 JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST \u0026 JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST \u0026 JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.","status":"published","published":"2026-10-22T01:21:25.068Z","modified":"2026-10-22T14:47:01.364Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-107819","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST \u0026 JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST \u0026 JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.","status":"published","published":"2026-10-22T01:21:25Z","modified":"2026-10-22T14:47:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:35.198677Z"}],"ghsa":[{"id":"GHSA-777p-gg7f-p2jf","title":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST \u0026 JSON API...","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST \u0026 JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST \u0026 JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.","status":"published","published":"2026-10-22T03:33:47Z","modified":"2026-10-22T15:33:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:14:16.352322Z"}],"nvd":[{"id":"CVE-2026-96385","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST \u0026 JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST \u0026 JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.","status":"published","published":"2026-10-22T02:17:08.75Z","modified":"2026-10-22T16:54:17.39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-96385","title":"REST \u0026 JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST \u0026 JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST \u0026 JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.","status":"published","published":"2026-10-22T01:21:25.068Z","modified":"2026-10-28T02:30:42.667457504Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:45:21.262447Z"},{"id":"DRUPAL-CONTRIB-2026-182","description":"This module enables you to add an extra authentication layer to the API.\n\nThe module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability.","status":"published","published":"2026-09-23T17:10:00Z","modified":"2026-09-23T19:15:06.681833074Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}