SA-CONTRIB-2026-298: Critical severity composer/drupal/rest_api_authentication vulnerability
Published Nov 4, 2026
·Updated
The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.
Credit
Sanjeev Kumar (ksanjeev284)
Affected Software
1 affected componentFixes available
composer/drupal/rest_api_authentication<3.2.1
3.2.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/rest_api_authenticationto a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Nov 4, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software