CVE-2026-81168: drupal/captcha_protected_page - Insufficient CAPTCHA Verification Vulnerability
Summary
CVE-2026-81168: This module enables site administrators to require CAPTCHA confirmation on specific pages. Affects drupal/captcha_protected_page versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'drupal/captcha_protected_page' module is designed for Drupal sites to enforce CAPTCHA confirmation on specific pages, enhancing security by preventing automated submissions. This module is particularly useful for forms that require user verification to ensure that submissions are made by real users rather than bots. However, a vulnerability has been identified that compromises this functionality.
Vulnerability Detail
The vulnerability arises from the module's inadequate validation of CAPTCHA verification cookies. This flaw allows unauthenticated users or automated bots to forge the CAPTCHA verification cookie, effectively bypassing the CAPTCHA checks. As a result, malicious actors can exploit this weakness to submit forms without proper verification, potentially leading to spam submissions or other forms of abuse.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, site administrators can disable the CAPTCHA feature on affected pages until the module is updated. This can be done by navigating to the module settings in the Drupal admin interface and unchecking the CAPTCHA requirement for specific pages.
Conclusion
In summary, the 'drupal/captcha_protected_page' module has a critical vulnerability that allows CAPTCHA verification to be bypassed due to insufficient cookie validation. It is crucial for site administrators to update to the patched version 1.0.2 to mitigate this risk. Temporary workarounds are available, but updating the module is the recommended solution.
See every vulnerability recorded for drupal/captcha_protected_page →
FAQ
The vulnerability allows unauthorized users to bypass CAPTCHA verification, leading to potential spam submissions and abuse of forms.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability has been patched in version 1.0.2 of the 'drupal/captcha_protected_page' module.
If an immediate update is not possible, consider disabling the CAPTCHA feature on affected pages as a temporary workaround.
For more information, you can reach out to the security researcher lovasoa via their Drupal profile at https://www.drupal.org/u/lovasoa.
