Description
The REST & JSON API Authentication module provides API authentication for Drupal sites.
The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/rest_api_authentication | < 3.2.1 | 3.2.1 | DRUPAL-CONTRIB-2026-298 |
Advisories 1
- WID-SEC-2026-4352 Drupal Erweiterungen: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026