PatchClock

PHP security digest · 23 Sep 2026

This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requ...

Unrated CVE-2026-96385

Package
drupal/rest_api_authentication
Fixed in
3.2.0
Published
Wed 23 Sep 2026, 18:10 LisbonUpdated Mon 26 Oct 2026, 01:27 Lisbon

In plain words

The module does not properly check authentication requirements for every API request. This can let an attacker bypass access controls on an API using the module.

Am I affected?

Look for drupal/rest_api_authentication and its version in composer.lock. The advisory lists 3.2.0 as fixed but does not provide an affected version range. It names no additional configuration, feature or database conditions, so the installed version is all there is to check.

What to do

Check which version you have, then update to a fixed release for your branch (3.2.0):

composer show drupal/rest_api_authentication | grep versions
composer update drupal/rest_api_authentication

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module enables you to add an extra authentication layer to the API.

The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.