View online: https://www.drupal.org/sa-contrib-2026-298 Project: REST & JSON API Authentication for Drupal [1] Project machine name: rest_api_authentication Date: 2026-November-04 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:None/CI:Some/II:All/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <3.2.1 CVE IDs: CVE-2026-122067 Description: The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated. Solution: Install the latest version: * Upgrade to REST & JSON API Authentication 3.2.1 [3]. If you can't immediately upgrade, ensure that you have an API key generated, and audit for suspicious access by administrative users in the logs. Reported By: * Sanjeev Kumar (ksanjeev284) [4] Fixed By: * Mohammed Hisam (hisam45) [5] * purva_shende [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/rest_api_authentication [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/rest_api_authentication/releases/3.2.1 [4] https://www.drupal.org/u/ksanjeev284 [5] https://www.drupal.org/u/hisam45 [6] https://www.drupal.org/u/purva_shende [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....