View online: https://www.drupal.org/sa-contrib-2026-281 Project: CAPTCHA [1] Project machine name: captcha Date: 2026-October-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Exploit/TD:All [2] Vulnerability: Session Replay (CAPTCHA bypass) Affected versions: <1.18.0 || >=2.0.0 <2.0.11 CVE IDs: CVE-2026-118582 Description: The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved. The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing. This is a follow-up to the earlier CAPTCHA replay fix (SA-CONTRIB-2026-015 [3] / CVE-2026-3214), which closed one replay path but left this one open. Solution: Install the latest version: * If you use the Captcha module 2.0.x, upgrade to Captcha 2.0.11 [4]. * If you use the Captcha module 8.x-1.x, upgrade to Captcha 8.x-1.18 [5]. Reported By: * James Gilliland (neclimdul) [6] of the Drupal Security Team * Rodrigo Cabo (rodrigo-cabo) [7] Fixed By: * Jakob P (japerry) [8] * James Gilliland (neclimdul) [9] of the Drupal Security Team * Rob Loach (robloach) [10] Coordinated By: * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Damien McKenna (damienmckenna) [12] of the Drupal Security Team * Michael Hess (mlhess) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Pierre Rudloff (prudloff) [15] of the Drupal Security Team * Stella Power (stella) [16] of the Drupal Security Team * Jess (xjm) [17] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [18] [1] https://www.drupal.org/project/captcha [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/sa-contrib-2026-015 [4] https://www.drupal.org/project/captcha/releases/2.0.11 [5] https://www.drupal.org/project/captcha/releases/8.x-1.18 [6] https://www.drupal.org/u/neclimdul [7] https://www.drupal.org/u/rodrigo-cabo [8] https://www.drupal.org/u/japerry [9] https://www.drupal.org/u/neclimdul [10] https://www.drupal.org/u/robloach [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/damienmckenna [13] https://www.drupal.org/u/mlhess [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/prudloff [16] https://www.drupal.org/u/stella [17] https://www.drupal.org/u/xjm [18] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....