[IT-SecNots] [Security-news] REST & JSON API Authentication for Drupal - Critical - Access bypass - SA-CONTRIB-2026-298

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-298

Project: REST & JSON API Authentication for Drupal [1]
Project machine name: rest_api_authentication
Date: 2026-November-04
Security risk: *Critical* 17 ∕ 25
AC:Basic/A:None/CI:Some/II:All/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass

Affected versions: <3.2.1
CVE IDs: CVE-2026-122067
Description: 
The REST & JSON API Authentication module provides API authentication for
Drupal sites.

The module does not properly reject requests when an API key is unconfigured,
allowing unauthenticated attackers to bypass authentication and potentially
access or modify protected resources. Sites are affected when API
authentication is enabled but the application API key has not been generated.

Solution: 
Install the latest version:

 * Upgrade to REST & JSON API Authentication 3.2.1 [3].

If you can't immediately upgrade, ensure that you have an API key generated,
and audit for suspicious access by administrative users in the logs.

Reported By: 
 * Sanjeev Kumar (ksanjeev284) [4]

Fixed By: 
 * Mohammed  Hisam (hisam45) [5]
 * purva_shende [6]

Coordinated By: 
 * Swan Kalata (akalata) [7] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Juraj Nemec (poker10) [10] of the Drupal Security Team
 * Jess  (xjm) [11] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/rest_api_authentication
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/rest_api_authentication/releases/3.2.1
[4] https://www.drupal.org/u/ksanjeev284
[5] https://www.drupal.org/u/hisam45
[6] https://www.drupal.org/u/purva_shende
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/bramdriesen
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/poker10
[11] https://www.drupal.org/u/xjm
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3633192

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at