Unencoded Token Vulnerability in ApostropheCMS CAPTCHA Integrations

CVE-2026-113667

What is CVE-2026-113667?

ApostropheCMS, an open-source Node.js content management system, presents a vulnerability within its CAPTCHA integrations. Versions prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha improperly handle user-supplied response tokens. This oversight allows attackers to craft tokens that can manipulate request parameters and potentially bypass CAPTCHA verification. While automated probing may reveal weaknesses, there has been no confirmed successful bypass or exposure of secrets directly linked to this vulnerability. The issue has been addressed in the aforementioned versions of the affected products.

References