CVE-2025-9553: Drupal API Key Manager Vulnerability

CVE-2025-9553 Overview

CVE-2025-9553 is a medium-severity vulnerability affecting the Drupal API Key manager contributed module. The flaw allows unauthenticated network attackers to access limited confidential information without user interaction. The vulnerability impacts confidentiality only, with no integrity or availability impact according to the CVSS vector.

The issue is tracked under the Drupal security advisory SA-CONTRIB-2025-103 and affects all versions of the api_key_manager module. Site administrators using this module for API credential management should review the Drupal Security Advisory and apply available updates.

Critical Impact
Unauthenticated remote attackers can retrieve limited sensitive data from Drupal sites using the API Key manager module, potentially exposing stored API keys or related configuration data.

Affected Products

Drupal API Key manager module (all versions, per advisory notation *.*)
Drupal sites using the api_key_manager_project:api_key_manager contributed module
Any deployment relying on the API Key manager for storing third-party service credentials

Discovery Timeline

2025-10-10 - CVE-2025-9553 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9553

Vulnerability Analysis

The vulnerability resides in the Drupal API Key manager contributed module, which manages API keys used to authenticate requests to third-party services. The advisory categorizes the issue under NVD-CWE-noinfo, indicating detailed weakness classification is not publicly available. Based on the CVSS vector, the flaw is exploitable over the network by unauthenticated attackers with no user interaction required.

The impact is limited to information disclosure. An attacker exploiting this issue can read a subset of protected data managed by the module. There is no reported impact to data integrity or system availability, meaning the module continues to function normally while leaking information.

The EPSS probability sits at 0.234% (14.4th percentile), reflecting a low predicted likelihood of exploitation in the near term. No public proof-of-concept, exploit code, or evidence of in-the-wild abuse has been recorded.

Root Cause

The vendor advisory identifies the module as containing a security weakness that exposes protected data over unauthenticated network requests. Because Drupal has assigned the generic NVD-CWE-noinfo classification, the precise root cause has not been publicly disclosed. Site operators should treat the module as leaking data through an unauthenticated interface until confirmed otherwise by the maintainer's release notes.

Attack Vector

Exploitation requires only network access to the affected Drupal site. An attacker sends crafted HTTP requests to endpoints exposed by the API Key manager module. No authentication, credentials, or user interaction is needed, which increases the exposure of internet-facing Drupal deployments. Successful exploitation returns confidential data managed by the module to the attacker.

Refer to the Drupal Security Advisory SA-CONTRIB-2025-103 for vendor-specific technical details and endpoint information.

Detection Methods for CVE-2025-9553

Indicators of Compromise

Unauthenticated HTTP requests targeting API Key manager module routes, particularly from anonymous sources or scanning infrastructure
Unexpected read access patterns to Drupal endpoints associated with api_key_manager before the site enforces authentication
Repeated enumeration attempts against Drupal REST or JSON:API endpoints on sites known to use the module

Detection Strategies

Inspect Drupal watchdog logs and web server access logs for anonymous requests to paths registered by the API Key manager module
Correlate web access logs with module route definitions to identify endpoints returning HTTP 200 responses to unauthenticated clients
Deploy web application firewall (WAF) rules that flag repeated requests to api_key_manager paths from a single source

Monitoring Recommendations

Enable verbose access logging for Drupal contributed modules that handle credentials or secrets
Alert on anomalous outbound API usage that may indicate leaked keys are being replayed by an attacker
Rotate any API keys managed by the module immediately after patching and monitor for continued use of the old keys

How to Mitigate CVE-2025-9553

Immediate Actions Required

Review the Drupal Security Advisory SA-CONTRIB-2025-103 and update the API Key manager module to the fixed release listed by the maintainer
Rotate all API keys previously stored in the module, as they must be considered potentially exposed
Restrict network access to Drupal administrative and module-specific paths until the update is applied
Audit third-party service logs for any misuse of API keys managed by affected sites

Patch Information

The Drupal Security Team publishes fixed versions of contributed modules through the project page linked in SA-CONTRIB-2025-103. Apply the updated release using composer update drupal/api_key_manager or the Drupal admin update workflow, then clear caches with drush cr. Confirm the running version matches the fixed version listed in the advisory before returning the site to production.

Workarounds

Temporarily uninstall the API Key manager module if a patched release is not yet available for your Drupal core version
Block access to module-specific paths at the reverse proxy or WAF layer for anonymous users
Restrict site access to authenticated users using Drupal's Permissions configuration until the update is applied

bash

# Update the module via Composer and clear caches
composer update drupal/api_key_manager --with-dependencies
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild

# Verify installed version matches the fixed release from SA-CONTRIB-2025-103
vendor/bin/drush pm:list --status=enabled --filter='name=api_key_manager'