CVE-2026-113667: ApostropheCMS: CAPTCHA response token not URL-encoded

Q: Which ApostropheCMS packages should be reviewed?

Review npm/apostrophe-form, npm/apostrophe-login-recaptcha, npm/apostrophe-login-hcaptcha, npm/@apostrophecms/form, npm/@apostrophecms/login-recaptcha, and npm/@apostrophecms/login-hcaptcha.

Q: What input must an attacker control to trigger the issue?

The attacker must supply a crafted CAPTCHA widget token containing additional key=value parameters, such as an injected secret or response parameter.

Q: Does this issue expose the configured CAPTCHA secret?

No. The available impact information states that the issue does not enable secret exfiltration.

Q: What is the likely operational impact before remediation?

Injected parameters can force CAPTCHA verification failures, causing denial of service for CAPTCHA-gated form and login flows. The issue can also support automated CAPTCHA-bypass probing.

Q: What mitigation is specified if the affected code must be changed?

Construct CAPTCHA verification requests using URL with searchParams, or an equivalent mechanism that URL-encodes the user-supplied token before adding it to the request.

Published Oct 20, 2026

Updated

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.

Details - packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}' - packages/login-recaptcha/index.js:44 — same pattern for login - packages/login-hcaptcha/index.js:47 — body: 'response=${token}&secret=${secret}'

PoC input.recaptcha = 'attackertoken&secret=INJECTEDSECRET&something=1' → resulting verify URL: https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attackertoken&secret=INJECTEDSECRET&something=1 (replicated exactly from recaptcha.js:39)

Impact Low: a crafted token smuggles extra key=value pairs (secret, extra response) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.

Remediation — Build the verify request with URL + searchParams (or encodeURIComponent on both secret and response), and validate the token against ^[A-Za-z0-9.-]{1,2048}$ before use.

Other sources

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.

— MITRE

Affected Software

6 affected componentsFixes available

npm/apostrophe-form<1.5.5

npm/apostrophe-login-recaptcha<1.2.1

npm/apostrophe-login-hcaptcha<1.3.0

npm/@apostrophecms/login-hcaptcha<1.3.0

1.3.0

npm/@apostrophecms/login-recaptcha<1.2.1

1.2.1

npm/@apostrophecms/form<1.5.5

1.5.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@apostrophecms/login-hcaptcha to a version that resolves this vulnerability.
Fixed in 1.3.0
Upgrade
Upgrade npm/@apostrophecms/login-recaptcha to a version that resolves this vulnerability.
Fixed in 1.2.1
Upgrade
Upgrade npm/@apostrophecms/form to a version that resolves this vulnerability.
Fixed in 1.5.5
Upgrade
Upgrade ApostropheCMS Form add-on to a version that resolves this vulnerability.
Fixed in 1.5.5
Upgrade
Upgrade ApostropheCMS login-recaptcha to a version that resolves this vulnerability.
Fixed in 1.2.1
Upgrade
Upgrade ApostropheCMS login-hcaptcha to a version that resolves this vulnerability.
Fixed in 1.3.0
Configuration
Build the verification request with URL and searchParams, or apply encodeURIComponent to both secret and response, and validate the token against ^[A-Za-z0-9._-]{1,2048}$ before use.
ApostropheCMS CAPTCHA verification integrations CAPTCHA token handling = URL.searchParams or encodeURIComponent; token validation /^[A-Za-z0-9._-]{1,2048}$/

Event History

Oct 20, 2026

CVE Published

via MITRE·05:33 PM

Data Sourced

via MITRE·05:33 PM

DescriptionWeakness

Advisory Published

via GitHub·06:05 PM

Data Sourced

via GitHub·06:05 PM

DescriptionWeaknessAffected Software

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which ApostropheCMS packages should be reviewed?

Review npm/apostrophe-form, npm/apostrophe-login-recaptcha, npm/apostrophe-login-hcaptcha, npm/@apostrophecms/form, npm/@apostrophecms/login-recaptcha, and npm/@apostrophecms/login-hcaptcha.

What input must an attacker control to trigger the issue?

The attacker must supply a crafted CAPTCHA widget token containing additional key=value parameters, such as an injected secret or response parameter.

Does this issue expose the configured CAPTCHA secret?

No. The available impact information states that the issue does not enable secret exfiltration.

What is the likely operational impact before remediation?

Injected parameters can force CAPTCHA verification failures, causing denial of service for CAPTCHA-gated form and login flows. The issue can also support automated CAPTCHA-bypass probing.

What mitigation is specified if the affected code must be changed?

Construct CAPTCHA verification requests using URL with searchParams, or an equivalent mechanism that URL-encodes the user-supplied token before adding it to the request.

CVE-2026-113667: ApostropheCMS: CAPTCHA response token not URL-encoded

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which ApostropheCMS packages should be reviewed?

What input must an attacker control to trigger the issue?

Does this issue expose the configured CAPTCHA secret?

What is the likely operational impact before remediation?

What mitigation is specified if the affected code must be changed?

Company

Resources

Contact

Frequently Asked Questions

Which ApostropheCMS packages should be reviewed?

What input must an attacker control to trigger the issue?

Does this issue expose the configured CAPTCHA secret?

What is the likely operational impact before remediation?

What mitigation is specified if the affected code must be changed?