GHSA-44qr-rrjg-2cqq: Npm/@apostrophecms/login-hcaptcha vulnerability

Q: Which deployments are exposed to this issue?

Deployments using npm/@apostrophecms/form, npm/@apostrophecms/login-recaptcha, or npm/@apostrophecms/login-hcaptcha are affected where CAPTCHA verification processes attacker-controlled widget tokens. The affected paths include form CAPTCHA verification and CAPTCHA-gated login flows.

Q: What does an attacker need to exploit it?

An attacker needs to submit a crafted CAPTCHA widget token containing additional query or form parameters, such as an injected secret or response value. No secret exfiltration is described; the stated impact is primarily causing CAPTCHA verification failures and probing for bypass behavior.

Q: What can be done if a patch cannot be applied immediately?

Ensure CAPTCHA tokens are encoded before they are included in outbound verification requests. The remediation specifically recommends constructing requests with URL and searchParams, or otherwise safely encoding the token rather than interpolating it directly into a URL or request body.

Q: How can I identify whether a deployment may be experiencing exploitation attempts?

Review CAPTCHA verification failures and outbound verification requests for token values containing parameter delimiters such as '&' and injected key=value pairs. A suspicious request may include multiple secret or response parameters after the user-controlled token is interpolated.

Published Oct 20, 2026

Updated

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.

Details - packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}' - packages/login-recaptcha/index.js:44 — same pattern for login - packages/login-hcaptcha/index.js:47 — body: 'response=${token}&secret=${secret}'

PoC input.recaptcha = 'attackertoken&secret=INJECTEDSECRET&something=1' → resulting verify URL: https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attackertoken&secret=INJECTEDSECRET&something=1 (replicated exactly from recaptcha.js:39)

Impact Low: a crafted token smuggles extra key=value pairs (secret, extra response) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.

Remediation — Build the verify request with URL + searchParams (or encodeURIComponent on both secret and response), and validate the token against ^[A-Za-z0-9.-]{1,2048}$ before use.

Affected Software

3 affected componentsFixes available

npm/@apostrophecms/login-hcaptcha<1.3.0

1.3.0

npm/@apostrophecms/login-recaptcha<1.2.1

1.2.1

npm/@apostrophecms/form<1.5.5

1.5.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@apostrophecms/login-hcaptcha to a version that resolves this vulnerability.
Fixed in 1.3.0
Upgrade
Upgrade npm/@apostrophecms/login-recaptcha to a version that resolves this vulnerability.
Fixed in 1.2.1
Upgrade
Upgrade npm/@apostrophecms/form to a version that resolves this vulnerability.
Fixed in 1.5.5
Compensating control
In packages/form/lib/recaptcha.js, packages/login-hcaptcha/index.js, and packages/login-recaptcha/index.js, build CAPTCHA verification requests with URL plus searchParams or encodeURIComponent applied to both secret and response/token, and validate the token against ^[A-Za-z0-9._-]{1,2048}$ before use.

Event History

Oct 20, 2026

Advisory Published

via GitHub·06:05 PM

Data Sourced

via GitHub·06:05 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using npm/@apostrophecms/form, npm/@apostrophecms/login-recaptcha, or npm/@apostrophecms/login-hcaptcha are affected where CAPTCHA verification processes attacker-controlled widget tokens. The affected paths include form CAPTCHA verification and CAPTCHA-gated login flows.

What does an attacker need to exploit it?

An attacker needs to submit a crafted CAPTCHA widget token containing additional query or form parameters, such as an injected secret or response value. No secret exfiltration is described; the stated impact is primarily causing CAPTCHA verification failures and probing for bypass behavior.

What can be done if a patch cannot be applied immediately?

Ensure CAPTCHA tokens are encoded before they are included in outbound verification requests. The remediation specifically recommends constructing requests with URL and searchParams, or otherwise safely encoding the token rather than interpolating it directly into a URL or request body.

How can I identify whether a deployment may be experiencing exploitation attempts?

Review CAPTCHA verification failures and outbound verification requests for token values containing parameter delimiters such as '&' and injected key=value pairs. A suspicious request may include multiple secret or response parameters after the user-controlled token is interpolated.

GHSA-44qr-rrjg-2cqq: Npm/@apostrophecms/login-hcaptcha vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can be done if a patch cannot be applied immediately?

How can I identify whether a deployment may be experiencing exploitation attempts?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can be done if a patch cannot be applied immediately?

How can I identify whether a deployment may be experiencing exploitation attempts?