Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication… (CVE-2026-96385)

CVE-2026-96385 describes an authentication bypass vulnerability in the Drupal REST & JSON API Authentication module. The issue allows an attacker to bypass authentication mechanisms by exploiting an alternate path or channel within the affected versions from 0.0.0 up to 3.2.0. The vulnerability is classified under CWE-288 (Authentication Bypass). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authentication controls, potentially gaining unauthorized access to protected resources or APIs. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor official Drupal security advisories for updates and apply any forthcoming patches promptly.