CVE-2026-81168: CWE-288 Authentication Bypass Using an Alternate Path or Channel in Drupal CAPTCHA Protected Page

This vulnerability (CVE-2026-81168) in the Drupal CAPTCHA Protected Page module is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). It allows an attacker to bypass authentication mechanisms by exploiting alternate paths or channels, effectively bypassing CAPTCHA protection. The affected versions include 0.0.0 through 1.0.2. The CVSS vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, resulting in limited confidentiality impact and no integrity or availability impact.

The impact is limited to a low-severity authentication bypass that could allow unauthorized access to functionality protected by CAPTCHA. There is no direct impact on data integrity or availability. Confidentiality impact is limited, reflecting the low CVSS score.

No official patch or remediation level has been provided by the vendor yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to vulnerable functionality or implementing additional authentication controls as a temporary measure.