May we please have a CVE ID reserved for this issue?

Important bits:
- this is from https://www.drupal.org/project/captcha/issues/3202776
- Submitting an incorrect CAPTCHA response does not stop normal login validation from running. As a result, an unauthenticated attacker can submit login attempts with an intentionally incorrect CAPTCHA and observe normal credential validation feedback. This allows an attacker to test username/password combinations without first solving CAPTCHA.
- json attached; date is correct for our publishing
- I did not find a link for this issue by Tag1; happy to add it if they comment here.

CommentFileSizeAuthor
CVE-2026-TBD-captcha-login-validation-feedback.json_.txt5.52 KBaangel

Comments

aangel created an issue. See original summary.

cmlara’s picture

cmlara
he/him
commented
Related issues: +#3584469: [policy] Treat CAPTCHA bypasses as non-security bugs

You may be interested in commenting on #3584469: [policy] Treat CAPTCHA bypasses as non-security bugs

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Postponed

I think this is postponed on #3584469: [policy] Treat CAPTCHA bypasses as non-security bugs

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Postponed » Active

Actually not sure #3202776: [PP-1][2.x] Do not execute other form validations if CAPTCHA is wrong generally qualifies as a vulnerability. It's a captcha bypass for validation only, which leads to potential DOS. It requires a lot of work by the attacker for moderate load on the server. We generally don't issue advisories for those scenarios.

cmlara’s picture

cmlara
he/him
commented

It requires a lot of work by the attacker for moderate load on the server. We generally don't issue advisories for those scenarios.

I just want to suggest to make sure your using CNA criteria not Drupal Security Team Criteria when making that evaluation. In my experience the Drupal Security Team criteria often under reports vulnerabilities that a CNA is required to process. There has been at least one incident where the DST/CNA was overruled by MITRE.

Hard to do/expensive I believe generally goes under complexity in a CVE scoring rather than acting as exclusionary for issuing a CVE.

It does sounds like this could have an impact on availability(which is covered under the CVE definition for a vulnerability), even if its cost expensive for the attacker, since the captcha is a DoS protection. There is also the fact that its impossible for the Drupal CNA to know what processing goes on in the backend. An LDAP based login might turn this into an amplification attack, or at least an internal DoS attack that can couple across the stack, at the very least depending upon how a site is configured the impact can be a bit exponential. That is not even considering that we may also open other aspects, like timing attacks, to be processed as the other codes execution paths occur.

Since the CNA can't know what processing occurs behind a captcha I'm not sure the CNA can reasonably assume that this might be only moderate load.

I will also note that I believe under CVE CNA Operation Rules v4.1 section 4.2.1.2 (https://www.cve.org/Resources/Roles/Cnas/CNA_Rules_v4.1.0.pdf) as a publicly disclosed vulnerability that the CNA is expected to process the CVE Request within 72 hours of original submission.

aangel’s picture

aangel commented

My immediate goal is to get this unstuck and I'll add more comments on the other thread.

As cmlara points out, CVE CNA Operation Rules v4.1 section 4.2.1.2 comes into play since this issue was disclosed back in 2021.

Chris's proposal has now reached 3.5 months without a conclusion. Until the new proposal is adopted (if that in fact happens), the existing rules should govern our actions. The CNA rules say:

"…if the CNA with the most appropriate scope: (1) preemptively documents that it will not assign, or (2) responds within 72 hours that it will not assign, or (3) does not respond within 72 hours, then an appropriate Root MUST make a Vulnerability determination. If the Root determines that one or more Vulnerabilities exist, the Root MUST direct a CNA-LR or another CNA with appropriate scope to assign as quickly as possible and no later than 72 hours after becoming aware of the first refusal. Ownership of the CVE Record MAY be transferred."

Since:

  1. the vulnerability has been made public, and
  2. we are beyond 72 hours, and
  3. the new proposal has not been adopted (meaning we continue operating under the current system)

may I please get the CVE ID while we sort out how to handle Chris's proposal?

cmlara’s picture

cmlara
he/him
commented

Side note: I re-read the linked issue, and this sounds like an access bypass not an availability issue as claimed in comment 4 (I made my response in comment 5 based on comment 4 without double checking the other aspects).

cilefen’s picture

cilefen commented

The existence of my proposal is irrelevant to this CVE request at this time.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Title: CAPTCHA: Request for new CVE ID for failure provides login credential validation feedback » Publish CVE-2026-19030 for CAPTCHA failure provides login credential validation feedback

Thanks for this additional discussion. Makes senes that current practices should be used to decide on filing a CVE here CVE-2026-19030.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs work

Moving to needs work for aangel to publish the article and then update the json here.