Project: 
REST & JSON API Authentication for Drupal
Project machine name: 
rest_api_authentication
Date: 
2026-November-04
Security risk: 
Critical 17 ∕ 25 AC:Basic/A:None/CI:Some/II:All/E:Theoretical/TD:Default
Vulnerability: 
Access bypass
Affected versions: 
<3.2.1
CVE IDs: 
CVE-2026-122067
Description: 

The REST & JSON API Authentication module provides API authentication for Drupal sites.

The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.

Solution: 

Install the latest version:

If you can't immediately upgrade, ensure that you have an API key generated, and audit for suspicious access by administrative users in the logs.

Reported By: 
Fixed By: 
Coordinated By: