- Package
- drupal/captcha
- Fixed in
- 1.18.0, 2.0.11
- Published
- Wed 28 Oct 2026, 17:27 LisbonUpdated Mon 2 Nov 2026, 07:27 Lisbon
In plain words
The CAPTCHA module does not fully invalidate a solved CAPTCHA session after a protected form is submitted. An attacker can submit that form again without solving a new CAPTCHA, weakening protection against spam registrations, comment spam and login brute-forcing. This is a follow-up to an earlier fix that left this replay path open.
Am I affected?
Look for drupal/captcha and its installed version in composer.lock. The listed fixed versions are 1.18.0 and 2.0.11, but the advisory does not supply affected version ranges. Check whether your project uses CAPTCHA-protected forms; the description explains that solved sessions are remembered to skip challenges on later steps of multi-step forms.
What to do
Check which version you have, then update to a fixed release for your branch (1.18.0, 2.0.11):
composer show drupal/captcha | grep versions
composer update drupal/captchaIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved.
The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing.
This is a follow-up to the earlier CAPTCHA replay fix (SA-CONTRIB-2026-015 / CVE-2026-3214), which closed one replay path but left this one open.