SA-CONTRIB-2026-281: Critical severity composer/drupal/captcha vulnerability
The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved. The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing. This is a follow-up to the earlier CAPTCHA replay fix (SA-CONTRIB-2026-015 / CVE-2026-3214), which closed one replay path but left this one open.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/captchato a version that resolves this vulnerability.Fixed in 2.0.11Fixed in 8.x-1.18
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the CAPTCHA module on protected multi-step forms are exposed when the module relies on a solved CAPTCHA session to skip challenges on later steps.
What must happen before the CAPTCHA can be bypassed?
The protected form must have been submitted once with a CAPTCHA session that was solved. Because that solved session is not fully invalidated, the form can then be submitted again without requiring a new challenge.
What security controls are weakened by this behavior?
The issue weakens CAPTCHA-based protections against automated submissions, including spam registrations, comment spam, and login brute-forcing.
Is this the same replay issue addressed by the earlier advisory?
No. This is a follow-up to SA-CONTRIB-2026-015 / CVE-2026-3214: that earlier fix closed one replay path, while this advisory describes a remaining replay path.