CVE-2026-113667

Summary

ApostropheCMS: CAPTCHA response token not URL-encoded

Severity

medium

EPSS

0.4% (p30)

CWE

CWE-116

Also known as

GHSA-44qr-rrjg-2cqq#@apostrophecms/form

Published

2026-10-20

Updated

2026-10-20

Advisory details

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.

Details

• packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'
• packages/login-recaptcha/index.js:44 — same pattern for login
• packages/login-hcaptcha/index.js:47 — body: 'response=${token}&secret=${secret}'

PoC

input.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'
→ resulting verify URL:
   https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attacker_token&secret=INJECTED_SECRET&something=1
# (replicated exactly from recaptcha.js:39)

Impact Low: a crafted token smuggles extra key=value pairs (secret, extra response) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.

Remediation — Build the verify request with URL + searchParams (or encodeURIComponent on both secret and response), and validate the token against ^[A-Za-z0-9._-]{1,2048}$ before use.

References

• https://github.com/advisories/GHSA-44qr-rrjg-2cqq
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq
• https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
• https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
• https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5

Related advisories

• CVE-2026-113656 — medium · npm/@apostrophecms/form
• CVE-2026-104252 — critical · Go/vitess.io/vitess
• CVE-2026-107845 — critical · Packagist/contao/comments-bundle
• CVE-2026-106102 — critical · npm/quasar
• GHSA-jqmf-mx4f-hfr6 — critical · PyPI/vibe-trading-ai
• CVE-2026-62681 — critical · npm/orval
• CVE-2026-62682 — critical · npm/orval
• CVE-2026-72717 — critical · npm/orval

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity