Executive brief
This Drupal module adds an extra authentication layer to protect API endpoints. The module fails to validate authentication requirements for all API requests, allowing attackers to bypass authentication controls and access protected APIs without proper credentials. This could expose sensitive data or enable unauthorized API operations.
Technical details
The module contains an access bypass vulnerability due to insufficient validation of authentication requirements across all API request paths. The vulnerability allows unauthenticated or improperly authenticated requests to reach protected API endpoints. A fix is available in version 3.2.0 and later.
Affected products
- Drupal REST & JSON API Authentication before 3.2.0
Timeline
- 2026-09-23: disclosed