{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0.0.0"
                  },
                  {
                    "fixed": "3.2.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6405bfa4fe5b9904b2a499521e87886ff7872767"
            }
          ],
          "repo": "https://git.drupalcode.org/project/rest_api_authentication",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "drupal",
    "cwe_ids": [
      "CWE-288"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96385.json"
  },
  "details": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST \u0026 JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST \u0026 JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.",
  "id": "CVE-2026-96385",
  "modified": "2026-10-23T02:30:32.586386449Z",
  "published": "2026-10-22T01:21:25.068Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.drupalcode.org/project/rest_api_authentication"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96385.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96385"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/project/rest_api_authentication"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-182"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "REST \u0026 JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182"
}