Vulnerabilities / CVE-2026-96385

CVE-2026-96385

Published 2026-10-22 · Awaiting Analysis

CVE-2026-96385

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

6.5 MEDIUM
CVSS 3.1 · CNA

0.3%
chance of exploitation in the next 30 days (EPSS; higher than 20% of CVEs)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.

Scores

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCNA

Affected products

Drupal REST & JSON API Authentication for Drupal: 0.0.0 to < 3.2.0

Weakness: CWE-288

Also known as: DRUPAL-CONTRIB-2026-182

1 references (advisories, patches, write-ups)

https://www.drupal.org/sa-contrib-2026-182

Sources: NVD, CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website