This vulnerability is an authentication bypass that allows attackers to circumvent the CAPTCHA verification mechanism in Drupal. By using an alternate path or channel, an adversary can submit form data without completing the CAPTCHA, thereby enabling automated spam or brute‑force attacks. The weakness is an access‑control failure, classified as CWE‑288, which can compromise the integrity of the submission process and allow unauthorized actions that should be protected by CAPTCHA.

Vulnerable releases of the Drupal CAPTCHA module include all versions from the initial release 0.0.0 up through 1.16.9, as well as 2.0.0 through 2.0.9. System administrators should verify whether these modules are installed on their Drupal sites.

The CVSS base score of 6.5 indicates moderate risk, and the EPSS score of less than 1 % reflects a low probability of exploitation in the wild. The vulnerability does not appear in the CISA KEV catalog. Attackers need only send crafted HTTP requests to the CAPTCHA endpoint; no special permission or privileged access is required. Because the flaw involves an alternate request channel, it can be triggered from a normal web browser or automated tool, making it potentially exploitable even against sites with minimal hardening.