"We run a non-profit summer camp and hired Ricochet to design our camper and staff database from scratch. Their initial design was custom fit to suit our needs and as those needs have evolved the helpful staff at Ricochet have insured that timely changes keep our database up to date and running smoothly. Thanks for the fantastic service and personal attention, it's made a huge difference for our camp!"
—Chrissie Endler, Camp del Corazon

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

Wed, 2026-09-23 10:10 — Anonymous (not verified)

Project: REST & JSON API Authentication for DrupalProject machine name: rest_api_authenticationDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <3.2.0CVE IDs: CVE-2026-96385Description: This module enables you to add an extra authentication layer to the API.
The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability.Solution: Install the latest version:

Upgrade to REST & JSON API Authentication 3.2.0.

Reported By:

Drew Webber (mcdruid) of the Drupal Security Team

Fixed By:

Drew Webber (mcdruid) of the Drupal Security Team
purva_shende

Coordinated By:

Swan Kalata (akalata) of the Drupal Security Team
Bram Driesen (bramdriesen) of the Drupal Security Team
Heine Deelstra (heine) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Jess (xjm) of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2026-182

Search form

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182