DRUPAL-CONTRIB-2026-298: Composer/drupal/rest_api_authentication vulnerability
The REST & JSON API Authentication module provides API authentication for Drupal sites.
The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/rest_api_authenticationto a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Frequently Asked Questions
Which sites are affected by this issue?
Affected sites have the REST & JSON API Authentication module enabled for API authentication and have not generated the application API key. The issue does not apply based on the provided information if an application API key has been generated.
What does an attacker need to exploit the bypass?
An attacker can exploit the issue without authentication when API authentication is enabled but the application API key is unconfigured. Successful exploitation may allow access to or modification of resources that are expected to be protected by API authentication.
What can be done if patching cannot happen immediately?
Generate and configure the application API key, and verify that API authentication rejects requests that do not provide valid authentication. Restrict access to protected API endpoints until that configuration has been confirmed.