CVE-2026-81168: Drupal CAPTCHA Protected Page Auth Bypass

CVE-2026-81168 Overview

CVE-2026-81168 is an authentication bypass vulnerability in the Drupal CAPTCHA Protected Page contributed module. The flaw allows attackers to bypass the module's protective functionality through an alternate path or channel [CWE-288]. The issue affects CAPTCHA Protected Page versions 0.0.0 through 1.0.2. Exploitation occurs over the network without authentication or user interaction, though the attack complexity is high. The vulnerability results in limited disclosure of information that the CAPTCHA gate is intended to protect.

Critical Impact
Remote attackers can bypass CAPTCHA-protected pages through an alternate channel, defeating the module's functionality guarantees on affected Drupal sites.

Affected Products

Drupal CAPTCHA Protected Page module versions 0.0.0 to 1.0.2
Drupal sites using the CAPTCHA Protected Page contributed module for gating access
Any deployment relying on this module to enforce CAPTCHA challenges before content access

Discovery Timeline

2026-09-02 - CVE-2026-81168 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81168

Vulnerability Analysis

The CAPTCHA Protected Page module for Drupal enforces a CAPTCHA challenge before granting access to specific pages. CVE-2026-81168 permits a network attacker to reach protected functionality without solving the CAPTCHA. The classification under Common Weakness Enumeration [CWE-288] identifies the issue as authentication bypass using an alternate path or channel. The primary consequence is loss of confidentiality on gated resources. Integrity and availability are not affected by this flaw.

Root Cause

The module fails to enforce its access check across every request path that leads to the protected content. An alternate route reaches the same underlying page handler while skipping the CAPTCHA verification step. This missing check on secondary code paths is the defining characteristic of [CWE-288] weaknesses. See the Drupal Security Advisory SA-CORE-2026-105 for vendor-supplied technical details.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests directly to the alternate path exposed by the affected module. The request reaches the resource that CAPTCHA Protected Page is configured to gate. Because the CAPTCHA challenge is not evaluated on that path, the attacker retrieves content that should require successful verification. Successful exploitation requires knowledge of the alternate request path or channel, which contributes to the higher attack complexity rating. No credentials or user interaction are required.

No public proof-of-concept exploit is available for CVE-2026-81168 at this time. Refer to the vendor advisory for structural details of the fix.

Detection Methods for CVE-2026-81168

Indicators of Compromise

HTTP requests to Drupal pages protected by the CAPTCHA Protected Page module that lack a preceding CAPTCHA submission event in the same session.
Access log entries showing successful 200 OK responses to gated URLs from client IPs with no corresponding CAPTCHA verification requests.
Repeated requests from a single source hitting alternate route patterns that map to protected content.

Detection Strategies

Correlate web server access logs with Drupal watchdog entries to identify requests reaching protected pages without an associated CAPTCHA validation event.
Deploy web application firewall rules that require a validated CAPTCHA session token before serving responses from gated URLs.
Baseline normal traffic patterns to protected pages and alert on anomalous route usage that bypasses the standard entry point.

Monitoring Recommendations

Enable verbose logging on the CAPTCHA Protected Page module and forward logs to a centralized analytics platform for correlation.
Monitor for spikes in requests to protected paths originating from previously unseen IP addresses or user agents.
Track version inventory of Drupal contributed modules and flag any host still running CAPTCHA Protected Page 1.0.2 or earlier.

How to Mitigate CVE-2026-81168

Immediate Actions Required

Identify all Drupal sites in the environment that have the CAPTCHA Protected Page module installed and record their versions.
Upgrade every affected site to a fixed release of the CAPTCHA Protected Page module as directed by the Drupal Security Advisory SA-CORE-2026-105.
Review web access logs for the affected paths since the module was deployed to detect prior bypass attempts.

Patch Information

Drupal has published Drupal Security Advisory SA-CORE-2026-105 covering this issue. Administrators should apply the fixed module release specified in that advisory. Versions 0.0.0 through 1.0.2 are affected and must be updated. After upgrading, clear the Drupal cache and verify that CAPTCHA challenges are enforced on every protected route.

Workarounds

Temporarily disable the CAPTCHA Protected Page module and replace its function with a hardened access control mechanism until patching is complete.
Add web server or reverse proxy rules that block direct access to the alternate paths and force traffic through the CAPTCHA-verified entry point.
Restrict access to protected pages by IP allowlisting where operationally feasible until the module is upgraded.

bash

# Configuration example: enumerate Drupal sites and module versions using Drush
drush pm:list --type=module --status=enabled --format=table \
  | grep -i "captcha_protected_page"

# After upgrading, clear caches to ensure the fixed routing takes effect
drush cache:rebuild