CVE-2025-13980
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Jan 28, 2026
CISA due date
—
The record
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0 before 1.6.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal/ckeditor5_premium_features | 0 | 1.2.10 |
Related vulnerabilities
- CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper… CWE-288
- CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop… CWE-288
- CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST &… CWE-288
- CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email… CWE-288
- CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in… CWE-288
- CVE-2026-81906 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an… CWE-288
- CVE-2026-81787 Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. CWE-288
- CVE-2026-81783 Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. CWE-288