CVE-2026-122067: Composer/drupal/rest_api_authentication vulnerability
The REST & JSON API Authentication module provides API authentication for Drupal sites.
The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/rest_api_authenticationto a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Frequently Asked Questions
Which sites are affected by this authentication bypass?
Affected sites have the REST & JSON API Authentication module enabled for API authentication and do not have an application API key generated. The issue applies to the Composer package composer/drupal/rest_api_authentication.
What does an attacker need to exploit the issue?
An attacker does not need to authenticate if API authentication is enabled but the application API key is unconfigured. They may be able to bypass authentication for protected API resources.
What is the immediate mitigation if patching is not available?
Generate and configure the application API key, or disable API authentication exposure until the key is configured. This removes the stated condition that allows requests to be accepted without proper rejection.
How can I determine whether my site is currently exposed?
Check whether the REST & JSON API Authentication module is enabled and being used for API authentication, then verify that an application API key has been generated and configured. A site meeting the enabled-module and missing-key conditions is affected.