CVE-2026-96385: CWE-288 Authentication Bypass Using an Alternate Path or Channel in Drupal REST & JSON API Authentication for Drupal

This vulnerability, classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), affects the REST & JSON API Authentication module for Drupal. It allows an attacker to bypass authentication mechanisms by exploiting alternate paths or channels in the authentication process. The affected versions are from 0.0.0 up to 3.2.0. No CVSS score or detailed exploit information is provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication controls, potentially gaining unauthorized access to the Drupal system via the REST & JSON API Authentication module. The exact impact depends on the privileges granted post-authentication bypass but could lead to unauthorized data access or modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Drupal's official security advisories for updates and apply patches when available.