| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/captcha | ≥ 2.0.0, < 2.0.11< 1.18.0 | 2.0.111.18.0 |
The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved.
The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing.
This is a follow-up to the earlier CAPTCHA replay fix (SA-CONTRIB-2026-015 / CVE-2026-3214), which closed one replay path but left this one open.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free