CERT24CVE-2026-118582 — CAPTCHA session replay and CAPTCHA bypassLoading data…
CERT24Threat Observatory
Period

CVE-2026-118582 — CAPTCHA session replay and CAPTCHA bypass

The Drupal CAPTCHA module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted can be submitted again without solving a new CAPTCHA.

← Back to intelligence

CVE-2026-118582 — CAPTCHA session replay and CAPTCHA bypass

The Drupal CAPTCHA module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted can be submitted again without solving a new CAPTCHA.