drupal-contrib-2026-298

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "<3.2.1",
        "source": "https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/rest_api_authentication/DRUPAL-CONTRIB-2026-298.json"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/rest_api_authentication",
        "purl": "pkg:composer/drupal/rest_api_authentication?repository_url=https:%2F%2Fpackages.drupal.org%2F8"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "<3.2.1"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-122067"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/ksanjeev284"
      ],
      "name": "Sanjeev Kumar (ksanjeev284)"
    }
  ],
  "details": "The REST & JSON API Authentication module provides API authentication for Drupal sites.\n\nThe module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affected when API authentication is enabled but the application API key has not been generated.",
  "id": "DRUPAL-CONTRIB-2026-298",
  "modified": "2026-11-04T20:30:04.241861564Z",
  "published": "2026-11-04T17:32:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-298"
    }
  ],
  "schema_version": "1.9.2"
}