CVE-2026-113667
Received Received - Intake

CAPTCHA Token Injection in ApostropheCMS Form Add-ons

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113667
EUVD
EUVD-2026-105217

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0
@apostrophecms form < 1.5.5
@apostrophecms login-hcaptcha < 1.3.0
@apostrophecms login-recaptcha < 1.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS is a Node.js content management system. The vulnerability exists in three CAPTCHA integrations (Form, login-recaptcha, login-hcaptcha) where user-supplied tokens are not properly encoded before being used in verification requests. This allows attackers to inject malicious parameters into CAPTCHA verification URLs, potentially disrupting CAPTCHA-protected login and form submission flows.

Detection Guidance

Check installed versions of affected packages: npm list @apostrophecms/form @apostrophecms/login-hcaptcha @apostrophecms/login-recaptcha. Monitor for CAPTCHA verification failures or unusual request patterns in logs.

Impact Analysis

The vulnerability primarily causes denial-of-service conditions by disrupting CAPTCHA verification. Automated bypass probing is possible, but successful CAPTCHA bypass or secret disclosure has not been established. Users may experience failed login attempts or form submissions due to manipulated verification requests.

Mitigation Strategies

Update affected packages to fixed versions: @apostrophecms/form 1.5.5+, @apostrophecms/login-hcaptcha 1.3.0+, @apostrophecms/login-recaptcha 1.2.1+. Review and enforce strict token validation regex patterns before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart