CVE-2026-81168CWE-288

CVE-2026-81168

Low · published September 2, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.6th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-09-02T17:18Z
Affected products (1)
ProductVersionsFixed in
captcha_protected_page_project/captcha_protected_page< 1.0.21.0.2
References (1)
https://www.drupal.org/sa-contrib-2026-105 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 12:32Z
    CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105
    cvelistv5