Live › vulnerability › CVE-2026-118582
The Drupal CAPTCHA module has an authentication bypass through an alternate path or channel, letting a request skip the CAPTCHA protection. The sources say an attacker can bypass functionality, but they do not state the exact data or access gained.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the CAPTCHA module on forms such as login or registration are exposed, since the bypass lets requests skip the CAPTCHA check. Sites without the module, or with it disabled, are not affected. The sources do not say which forms or configurations are most at risk.
No product ranges from the sources yet.
drush pm:list --filter=captcha or the Drupal admin Extend page.1.18.0 and earlier, and 2.0.0 through 2.0.11, as affected.2.0.11 for the 2.x line, or after 1.18.0 for the 1.x line; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-118582")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.