CVE-2026-3214
CVE-2026-3214 · CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.
CVSS 6.5 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
captcha
- Versions
- ≥ 0.0.0, < 1.17.0: Affected (semver)
- ≥ 2.0.0, < 2.0.10: Affected (semver)
Update to 1.17.0; Update to 2.0.10
drupal/captcha Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.17.0
- ECOSYSTEM: ≥ 2.0.0, < 2.0.10
Update to 1.17.0; Update to 2.0.10