CVE-2026-96385 in REST & JSON API Authentication
Summary
by MITRE • 10/22/2026
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw represents a critical authentication bypass mechanism within the Drupal ecosystem, specifically targeting modules that facilitate data exchange through Representational State Transfer (REST) and JavaScript Object Notation (JSON) APIs. This vulnerability stems from an architectural oversight where the application fails to enforce consistent authentication checks across all entry points or communication channels available to it. In complex web applications like Drupal, multiple pathways often exist for accessing protected resources, including standard HTTP requests, module-specific API endpoints, and background processing queues. When a system allows access via an alternate path that does not invoke the primary authentication middleware or validation logic, attackers can exploit this discrepancy to gain unauthorized access to sensitive data or administrative functions without providing valid credentials. This type of flaw is fundamentally rooted in CWE-287, which classifies Improper Authentication, and more specifically aligns with CWE-345 regarding Insufficient Verification of Data Authenticity when the system accepts input from an unverified channel as if it were authenticated through standard means.
The technical nature of this vulnerability relies on the principle that authentication controls must be applied uniformly to all resources regardless of how they are accessed. In the context of Drupal versions ranging from 0.0.0 up to and including 3.2.0, the REST and JSON API modules likely implement separate routing or service definitions for different types of requests. If one pathway, such as a direct module callback or an internal API handler, bypasses the global authentication layer that protects other parts of the site, it creates a side-channel attack vector. An attacker can identify these alternate paths through enumeration or by analyzing the application's configuration files and routing tables. By directing malicious payloads to this unguarded channel, the attacker effectively circumvents the login mechanism entirely. This is particularly dangerous because API endpoints are often designed for programmatic access and may expose high-privilege operations that are not available through the standard web interface, thereby amplifying the potential impact of a successful bypass.
The operational impact of such an authentication bypass can be severe, ranging from unauthorized data exfiltration to complete system compromise depending on the privileges associated with the exposed API endpoints. Attackers who successfully exploit this flaw can read confidential user information, modify content without authorization, or execute administrative actions that should require elevated permissions. In many cases, REST APIs provide direct access to database operations, meaning an attacker could potentially alter site configuration, inject malicious code through serialized data structures if further input validation is also lacking, or disrupt service availability by manipulating core system states. The lack of authentication means there are no audit trails linking these actions to a specific user identity in the traditional sense, complicating forensic analysis and incident response efforts. Furthermore, because this affects versions starting from 0.0.0, it implies that legacy systems or those running older stable releases within the specified range are inherently vulnerable unless patched, posing a significant risk for organizations with long-term maintenance cycles or delayed update policies.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Initial Access and Privilege Escalation, specifically T1078 Valid Accounts if combined with credential stuffing on other vectors, but more directly it reflects the exploitation of misconfigured access controls which can facilitate lateral movement within an environment. The absence of proper authentication checks allows attackers to establish a foothold that is difficult to detect using standard web application firewalls configured only for HTTP request validation against known login pages. To mitigate this risk, immediate action must be taken by upgrading the Drupal REST and JSON API modules to versions newer than 3.2.0 where these architectural flaws have been addressed. Developers should also conduct a thorough review of all custom module implementations to ensure that no alternate paths or internal services bypass the central authentication service layer. Implementing strict input validation, enforcing consistent security headers across all endpoints, and utilizing automated vulnerability scanning tools focused on API security can further reduce the attack surface. Regular audits of access control lists and routing configurations are essential to prevent similar discrepancies from arising in future updates or custom developments within the Drupal framework.