This vulnerability in Drupal CAPTCHA allows an attacker to bypass the authentication checks by using an alternate path or channel. The flaw is classified as an Authentication Bypass for Privilege Functions (CWE‑288) and can enable attackers to access functionality that should require proper authentication, potentially providing unauthorized control over site features.

Drupal CAPTCHA module versions prior to 1.17.0 and prior to 2.0.10 are affected. Users running these versions should verify their installation and update to the latest releases to eliminate the flaw.

The CVSS base score of 6.5 indicates a moderate severity. EPSS is below 1%, suggesting a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation likely requires sending crafted web requests to the CAPTCHA endpoint through a non‑standard path, and the attacker may need network access to the affected site. If the site uses Drupal CAPTCHA for critical authentication flows, the impact could be significant.