Medium, CVSS 5.3npmAmendedPublished
ApostropheCMS: CAPTCHA response token not URL-encoded
CVE-2026-113667 · GHSA-44qr-rrjg-2cqq
- Affected
- npm @apostrophecms/login-recaptcha < 1.2.1
- Fixed in
- 1.2.1· Vendor fix available
- Issue
- Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}' - packages/login-recaptcha/index.js:44 — same pattern for login - packages/login-hcaptcha/index.js:47 — body: 'response=${token}&secret=${secret}' PoC Impact Low: a crafted token smuggles extra key=value pairs (secret, extra response) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration. Remediation — Build the verify request with URL + searchParams (or encodeURIComponent on both secret and response), and validate the token against ^[A-Za-z0-9.-]{1,2048}$…
Recommended action: Upgrade to 1.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.