Authentication Bypass Vulnerability in CAPTCHA Protected Page by Drupal
CVE-2026-81168

3.7LOW

Key Information:

Vendor

Drupal
Status
Captcha Protected Page
Vendor
CVE Published:
2 September 2026

What is CVE-2026-81168?

A vulnerability in the CAPTCHA Protected Page component of Drupal allows attackers to bypass authentication by exploiting an alternate path or channel. This flaw impacts versions 0.0.0 through 1.0.2, enabling unauthorized access and potentially compromising sensitive functionalities. It's crucial for users of affected versions to update to secure their installations, as attackers may exploit this issue to gain unapproved access.

Affected Version(s)

CAPTCHA Protected Page 0.0.0 < 1.0.2

References

https://www.drupal.org/sa-contrib-2026-105

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lovasoa
Carlo Miguel Agno (carlagno)
Mark Jayson Gruta (mjgruta)
Swan Kalata (akalata)
Carlo Miguel Agno (carlagno)
Greg Knaddison (greggles)
Heine Deelstra (heine)
Juraj Nemec (poker10)
Jess (xjm)
.