Adam Nagy

A functionality bypass exists in Drupal CAPTCHA due to insufficient invalidation of security tokens. An attacker may bypass the CAPTCHA on subsequent submissions if they first successfully solve at least one CAPTCHA manually to obtain valid tokens.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), in the Drupal SpamSpan filter. This allows for Cross-Site Scripting (XSS) attacks.