The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Project:
Date:
2026-August-26
Vulnerability:
Cookie Forgery
Affected versions:
<1.0.2
CVE IDs:
CVE-2026-81168
Description:
This module enables site administrators to require CAPTCHA confirmation on specific pages.
The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirely.
Solution:
Install the latest version:
- If you use the CAPTCHA Protected Page module, upgrade to CAPTCHA Protected Page 1.0.2.
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Carlo Miguel Agno (carlagno)
- Greg Knaddison (greggles) of the Drupal Security Team
- Heine Deelstra (heine) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
