All vulnerabilities
CVE-2026-96385

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Drupal REST & JSON API Authentication for DrupalApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.2.0Fixed versionCVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 3.2.0REST & JSON API Authentication for DrupalCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.

Text from CVE List

Affected versions 1

  • REST & JSON API Authentication for Drupalaffected: 0.0.0 before 3.2.0CVE List

References 1