Live › vulnerability › CVE-2026-113667
Go to dashboardThe ApostropheCMS form and login CAPTCHA modules put the user-supplied CAPTCHA token into the server-side verify request without URL-encoding it. A crafted token can inject extra query parameters into the reCAPTCHA or hCaptcha verification call, which can force verification failures and enable automated bypass probing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @apostrophecms/form | npm | < 1.5.5 | 1.5.5 |
| @apostrophecms/login-recaptcha | npm | < 1.2.1 | 1.2.1 |
| @apostrophecms/login-hcaptcha | npm | < 1.3.0 | 1.3.0 |
Check installed versions: npm ls @apostrophecms/form @apostrophecms/login-recaptcha @apostrophecms/login-hcaptcha Flagged if @apostrophecms/form is below 1.5.5, login-recaptcha below 1.2.1, or login-hcaptcha below 1.3.0.
1.5.5, @apostrophecms/login-recaptcha to 1.2.1, and @apostrophecms/login-hcaptcha to 1.3.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.
Details
packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'packages/login-recaptcha/index.js:44 — same pattern for loginpackages/login-hcaptcha/index.js:47 — body: 'response=${token}&secret=${secret}'PoC
input.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'
→ resulting verify URL:
https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attacker_token&secret=INJECTED_SECRET&something=1
# (replicated exactly from recaptcha.js:39)
Impact
Low: a crafted token smuggles extra key=value pairs (secret, extra response) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.
Remediation — Build the verify request with URL + searchParams (or encodeURIComponent on both secret and response), and validate the token against ^[A-Za-z0-9._-]{1,2048}$ before use.
This page as .md · .json · in your agent: get_signal("CVE-2026-113667")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.