Authentication Bypass in Drupal CAPTCHA Enables Functionality Bypass

Publication date: 2026-03-25

Last updated on: 2026-04-02

Assigner: Drupal.org

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-25

Last Modified

2026-04-02

Generated

2026-07-06

AI Q&A

2026-03-25

EPSS Evaluated

2026-07-05

NVD

CVE-2026-3214

EUVD

EUVD-2026-15473

Affected Vendors & Products

Vendor	Product	Version / Range
arnabdotorg	captcha	to 8.x-1.17 (exc)
arnabdotorg	captcha	From 2.0.0 (inc) to 2.0.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authentication Bypass Using an Alternate Path or Channel in the Drupal CAPTCHA module. It allows attackers to bypass CAPTCHA functionality, which is intended to verify that a user is human and prevent automated access. The issue affects versions of the CAPTCHA module before 1.17.0 in the 0.x series and before 2.0.10 in the 2.x series.

Impact Analysis

By bypassing the CAPTCHA functionality, attackers can potentially automate interactions with the Drupal site that are meant to be restricted to human users. This could lead to increased spam, automated account creation, or other malicious automated activities that the CAPTCHA was designed to prevent.

Hi! I’m here to help you understand CVE-2026-3214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70