Drupal REST Auth CVE-2026-96385

Exploitation requires the target Drupal site to have the contributed 'REST & JSON API Authentication' module installed and enabled at version 0.0.0 through 3.2.0, with its REST/JSON API endpoints exposed to the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed once the vulnerable module is reachable over the network. The primary limiting factor is deployment scope: this is an optional contrib module, so only sites that have chosen to install it for API authentication are affected - core Drupal and sites not using this module are not in scope. The exact alternate path or channel used to bypass authentication is not described in the available sources.

This is a moderate-priority issue whose signals are largely consistent with its mid-range CVSS 6.5 rating rather than a critical emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity bypass requiring no prior authentication or user interaction, which is why an authentication-bypass flaw (CWE-288) still only lands at 6.5 - the impact is capped at low confidentiality and low integrity (C:L/I:L) with no availability impact (A:N), implying the bypass grants limited access rather than full administrative control. Exploitation-likelihood signals point away from imminent mass exploitation: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing (not actively exploited per available data), and no public exploit or PoC reference is present in the input. The vuln.today decision label is 'this_month,' aligning with a 'patch on a normal cadence' posture rather than act_now/emergency. No SSVC exploitation/automatable/technical-impact decision values were supplied, so that framework cannot be independently applied here. The main caveat: the CWE and title describe an auth bypass via an alternate path/channel, but the supplied sources do not describe the exact alternate path, so the precise mechanism and what access is gained are not confirmed from available data. No signals conflict - low EPSS, no KEV, and a mid CVSS all agree this is a real but non-urgent fix.

A remote, unauthenticated attacker sends crafted REST or JSON API requests to a Drupal site running the 'REST & JSON API Authentication' module (≤3.2.0), using an alternate authentication path or channel to bypass the module's checks and obtain access as a user they should not be authenticated as. Given C:L/I:L, this likely exposes restricted data and permits limited unauthorized modification via the API rather than full site takeover. No public exploit or PoC was identified in the available data; the exact alternate path used to bypass authentication is not described in the supplied sources.