PT-2026-22086 · Drupal+2 · Captcha+1

Adam Nagy + 16 · Published 2026-02-25 · Updated 2026-03-30 · CVE-2026-3214

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal CAPTCHA versions 0.0.0 through 1.16.9 Drupal CAPTCHA versions 2.0.0 through 2.0.9

Description A functionality bypass exists in Drupal CAPTCHA due to insufficient invalidation of security tokens. An attacker may bypass the CAPTCHA on subsequent submissions if they first successfully solve at least one CAPTCHA manually to obtain valid tokens.

Recommendations Update Drupal CAPTCHA to version 1.17.0 or later. Update Drupal CAPTCHA to version 2.0.10 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-3214

DRUPAL-CONTRIB-2026-015

Affected Products

Captcha

Drupal/Captcha

References · 5

• https://drupal.org/sa-contrib-2026-015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3214 · Security Note
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-015 · Vendor Advisory
• https://twitter.com/CVEnew/status/2038618163739316733 · Twitter Post
• https://twitter.com/infoflowcloud/status/2038620189692989448 · Twitter Post