Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-02T13:18:12.580Z",
  "pubdate": "2026-09-02T13:18:12.580Z",
  "executiveSummary": "This vulnerability is classified as an Authentication Bypass Using an Alternate Path or Channel (CWE-288).\nThe issue resides within the CAPTCHA Protected Page module for Drupal, affecting all versions from 0.0.0 through 1.0.2.\nThe vulnerability allows an unauthenticated or authenticated attacker to bypass intended CAPTCHA security controls by utilizing an alternative, unintended request path.\nBy circumventing the CAPTCHA validation process, attackers can potentially perform unauthorized actions that the CAPTCHA was specifically designed to protect, such as automated form submissions, brute-force attacks, or scraping protected content.\nThe impact includes the loss of integrity for automated security workflows and increased susceptibility to bot-driven exploitation.\nExploitation requires no special privileges, as the bypass mechanism is inherently accessible via the application's request structure.",
  "technicalDetails": "The vulnerability stems from improper validation logic within the CAPTCHA Protected Page module's request handling mechanism. Specifically, the module fails to enforce consistent authentication and verification checks across all entry points that access the protected functionality.\nIn standard implementations, the CAPTCHA verification routine is invoked upon the execution of a specific controller or hook. However, the module implements an alternate path or channel that does not trigger the necessary security callback, effectively rendering the CAPTCHA challenge mechanism inert for that specific route.\nThe attack flow commences when an attacker identifies the secondary, unprotected URI or resource path that bypasses the primary CAPTCHA-enforced handler. By crafting requests directly to this alternate path, the attacker avoids the invocation of the captcha_validate or equivalent protection functions.\nBecause the system trusts the request originating from this alternate path without re-validating the CAPTCHA status, the application proceeds to execute the requested business logic. This creates a state where the client is granted access to restricted functionality despite having never successfully solved the cryptographic or cognitive challenge required by the site configuration.\nAffected versions 0.0.0 through 1.0.2 contain this logic error. The vulnerable component is the routing or access control interface of the CAPTCHA Protected Page module. The exploitation does not require prior knowledge of legitimate user credentials, as the bypass is at the architectural level rather than the authentication level.\nPost-exploitation, an attacker can automate interactions that were intended to be restricted to human users. This facilitates high-volume automated attacks, including but not limited to registration flooding, bulk contact form submissions, and automated login attempts against protected Drupal entities. Since the bypass is path-based, it remains effective until the underlying code logic is patched to unify access control policies across all available entry points for the protected module."
}