---
id: "CVE-2026-112067"
kind: "vulnerability"
aliases: ["CVE-2026-112067"]
title: "CAPTCHA extension leaks its answer inside the image, letting bots pass"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["captcha", "forms", "other", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T10:17:03+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:40:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112067", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# CAPTCHA extension leaks its answer inside the image, letting bots pass

The extension embeds the correct answer to each CAPTCHA inside the image data it serves. Anyone who requests a CAPTCHA image can read the answer and submit it, so automated clients can pass the challenge.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112067

## From the sources

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_