CVE-2026-118582

The Drupal CAPTCHA module is vulnerable to a functionality bypass due to incomplete invalidation of solved CAPTCHA sessions. While the module remembers solved challenges to allow multi-step forms to proceed, it fails to fully invalidate these sessions, allowing a protected form to be resubmitted ...