The vulnerability permits attackers to bypass authentication by exploiting an alternate path or channel in the REST & JSON API Authentication module for Drupal. Once authenticated, attackers can gain unauthorized access to data and operations normally protected, potentially compromising confidentiality and integrity of the site’s content. This weakness is classified as CWE-288, reflecting unauthorized access or elevation of privileges.

The issue affects the Drupal REST & JSON API Authentication module for all releases from 0.0.0 up through 3.2.0. Any Drupal installation deploying this module in that range is susceptible to the bypass.

The EPSS score on the advisory is 0.00182, which is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploitation yet. The likely attack vector is a web request to the API, based on the description that an alternate path or channel can be used to bypass authentication. The attacker can therefore send a specially crafted request to the REST endpoints, which if successful removes the authentication requirement and allows unauthorized actions. The lack of an official public fix in the advisory and the moderate severity classification means administrators should assess whether the module is required and consider immediate mitigation steps. The CVSS score of 6.5 is consistent with a moderate severity level.