An authentication bypass vulnerability exists in the Drupal CAPTCHA module, allowing functionality bypass via an alternate path or channel. This affects CAPTCHA versions from 0.0.0 to 1.18.0 and from 2.0.0 to 2.0.11. The vulnerability is identified as CWE-288 and was published on October 30, 2026.