{"id":"CVE-2026-113667","aliases":["GHSA-44qr-rrjg-2cqq"],"title":"ApostropheCMS: CAPTCHA response token not URL-encoded","summary":"ApostropheCMS: CAPTCHA response token not URL-encoded","severity":"medium","cvss":5.3,"cwe":["CWE-116"],"vendor":"apostrophecms","product":"@apostrophecms/form","ecosystem":"npm","affected":["@apostrophecms/form < 1.5.5","@apostrophecms/login-recaptcha < 1.2.1","@apostrophecms/login-hcaptcha < 1.3.0"],"patched":["@apostrophecms/form 1.5.5","@apostrophecms/login-recaptcha 1.2.1","@apostrophecms/login-hcaptcha 1.3.0"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T18:05:36Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-44qr-rrjg-2cqq","references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq"},{"url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"},{"url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5"},{"url":"https://github.com/advisories/GHSA-44qr-rrjg-2cqq"}],"tags":["ghsa","npm","cve.org"],"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","ingestedAt":"2026-10-20T18:14:37.212Z","slug":"CVE-2026-113667","body":"## Overview\n\n**Summary**\nForm and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.\n\n**Details**\n- `packages/form/lib/recaptcha.js:39` — `recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'`\n- `packages/login-recaptcha/index.js:44` — same pattern for login\n- `packages/login-hcaptcha/index.js:47` — `body: 'response=${token}&secret=${secret}'`\n\n**PoC**\n```\ninput.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'\n→ resulting verify URL:\n   https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attacker_token&secret=INJECTED_SECRET&something=1\n# (replicated exactly from recaptcha.js:39)\n```\n\n**Impact**\nLow: a crafted token smuggles extra `key=value` pairs (`secret`, extra `response`) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.\n\n**Remediation** — Build the verify request with `URL` + `searchParams` (or `encodeURIComponent` on both `secret` and `response`), and validate the token against `^[A-Za-z0-9._-]{1,2048}$` before use.\n\n## Affected packages\n\n- `@apostrophecms/form < 1.5.5`\n- `@apostrophecms/login-recaptcha < 1.2.1`\n- `@apostrophecms/login-hcaptcha < 1.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@apostrophecms/form 1.5.5`\n- `@apostrophecms/login-recaptcha 1.2.1`\n- `@apostrophecms/login-hcaptcha 1.3.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}