CVE-2026-112067
Received Received - Intake

CAPTCHA Answer Embedded in Image Data Allowing Automated Bypass

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112067
EUVD
EUVD-2026-104872

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TYPO3 Extension "Accessible Form Captcha" 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-804 The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
CWE-656 The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the TYPO3 extension 'Accessible Form Captcha' allows automated clients to bypass CAPTCHA challenges. The correct answer is hidden within the CAPTCHA image data itself, and since the audio feature embedding the answer is enabled by default, anyone requesting the image can extract and submit the answer. This defeats the purpose of the CAPTCHA as a bot protection mechanism.

Detection Guidance

Check if the TYPO3 extension 'Accessible Form Captcha' (bw_captcha) versions 4.0.0 to 5.4.1 are installed. Inspect CAPTCHA image responses for embedded answers in metadata or image data.

Impact Analysis

If you use the vulnerable extension (versions 4.0.0 to 5.4.1) on forms that rely solely on CAPTCHA for protection, automated bots can bypass the CAPTCHA and submit forms. This could lead to spam submissions, unauthorized access, or abuse of your forms, compromising data integrity and user experience.

Mitigation Strategies

Update the 'Accessible Form Captcha' extension to version 5.4.2 or later immediately to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112067. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart