Captcha EUVD-2026-15473

Without CVSS metrics or EPSS scoring, the risk assessment relies on vulnerability class analysis and vendor response patterns. CWE-288 authentication bypass vulnerabilities are typically high-impact because they directly undermine a security control designed to prevent account compromise and spam. The fact that Drupal issued a security advisory (SA-CONTRIB-2026-015) and patched versions are available suggests the vulnerability is actionable and not purely theoretical. The presence of distinct affected version ranges (pre-1.17.0 and 2.0.0-2.0.9) indicates this is a real, reproducible issue rather than a low-probability edge case. However, without evidence of active exploitation in the wild, public POC availability, or known automation, this should be prioritized as a medium-to-high urgency remediation based on deployment scope rather than raw exploitability metrics. Organizations running the Drupal CAPTCHA module should treat this as a mandatory patch priority due to the direct authentication impact.

An attacker discovers that bot account registration forms protected by the vulnerable Drupal CAPTCHA module can be bypassed by submitting requests through an alternate API endpoint or by manipulating the request channel (e.g., via direct HTTP POST to a form handler that does not validate CAPTCHA). The attacker leverages this to automate the creation of hundreds of spam accounts or to distribute credential-stuffing attacks without triggering the intended CAPTCHA challenge. No special privileges are required; the attack is purely logic-based and can be executed at scale with minimal complexity, making it an attractive target for spam botnets and account abuse campaigns.