DRUPAL-CONTRIB-2026-281: Composer/drupal/captcha vulnerability

Q: Who is exposed to this issue?

Sites using the Drupal CAPTCHA module on protected forms are exposed if an attacker can first complete a CAPTCHA and submit the form. Forms used for registrations, comments, or login protection are specifically identified as potentially affected.

Q: What must an attacker do to bypass a subsequent CAPTCHA challenge?

The attacker must solve the CAPTCHA and submit the protected form once. Because the solved CAPTCHA session is not fully invalidated, the same form can then be submitted again without solving a new challenge.

Q: How can I tell whether the issue is being exploited?

The provided information does not identify a definitive detection method. Review submissions to CAPTCHA-protected forms for repeated or automated activity occurring after an initial successful CAPTCHA solve, especially for registrations, comments, and login attempts.

Published Oct 28, 2026

Updated

The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved.

The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing.

This is a follow-up to the earlier CAPTCHA replay fix (SA-CONTRIB-2026-015 / CVE-2026-3214), which closed one replay path but left this one open.

Affected Software

2 affected componentsFixes available

composer/drupal/captcha<1.18.0

1.18.0

composer/drupal/captcha>=2.0.0<2.0.11

2.0.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/captcha to a version that resolves this vulnerability.
Fixed in 1.18.0
Upgrade
Upgrade composer/drupal/captcha to a version that resolves this vulnerability.
Fixed in 2.0.11

Event History

Oct 28, 2026

Advisory Published

via OSV·05:27 PM

Data Sourced

via OSV·05:27 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Sites using the Drupal CAPTCHA module on protected forms are exposed if an attacker can first complete a CAPTCHA and submit the form. Forms used for registrations, comments, or login protection are specifically identified as potentially affected.

What must an attacker do to bypass a subsequent CAPTCHA challenge?

The attacker must solve the CAPTCHA and submit the protected form once. Because the solved CAPTCHA session is not fully invalidated, the same form can then be submitted again without solving a new challenge.

How can I tell whether the issue is being exploited?

The provided information does not identify a definitive detection method. Review submissions to CAPTCHA-protected forms for repeated or automated activity occurring after an initial successful CAPTCHA solve, especially for registrations, comments, and login attempts.

DRUPAL-CONTRIB-2026-281: Composer/drupal/captcha vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to bypass a subsequent CAPTCHA challenge?

How can I tell whether the issue is being exploited?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to bypass a subsequent CAPTCHA challenge?

How can I tell whether the issue is being exploited?