Executive brief
CAPTCHA Protected Page is a Drupal module that adds challenge-response verification to sensitive pages on a website to prevent automated access. The module fails to properly validate its verification cookies, allowing unauthenticated attackers or bots to forge cookies and completely bypass CAPTCHA protection, gaining unauthorized access to protected pages.
Technical details
This is a cookie forgery vulnerability (CWE-754/CWE-347) in the CAPTCHA Protected Page Drupal module. The vulnerability stems from insufficient validation of CAPTCHA verification cookies—the module does not cryptographically sign or properly validate these cookies before accepting them. An unauthenticated attacker can craft a forged cookie to bypass CAPTCHA verification, accessing protected pages without solving the challenge. No authentication or user interaction is required; the attack is network-accessible. The vulnerability affects versions prior to 1.0.2, which has been released with a fix.
Affected products
- Drupal CAPTCHA Protected Page before 1.0.2
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Version 1.0.2 released with fix