An authentication bypass issue exists where the module fails to fully invalidate a solved CAPTCHA session. This allows a protected form that has been submitted once to be submitted again without solving a new challenge. This flaw weakens protection against automated submissions, including login brute-forcing, comment spam, and spam registrations.