ApostropheCMS: CAPTCHA response token not URL-encoded
Summary
Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.
Details
packages/form/lib/recaptcha.js:39—recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'packages/login-recaptcha/index.js:44— same pattern for loginpackages/login-hcaptcha/index.js:47—body: 'response=${token}&secret=${secret}'
PoC
input.recaptcha = 'attacker_token&secret=INJECTED_SECRET&something=1'
→ resulting verify URL:
https://www.google.com/recaptcha/api/siteverify?secret=<real>&response=attacker_token&secret=INJECTED_SECRET&something=1
# (replicated exactly from recaptcha.js:39)Impact
Low: a crafted token smuggles extra key=value pairs (secret, extra response) into the outbound verify call, forcing verification failures (DoS of the captcha gate and of captcha-gated login/form flows) and enabling automated bypass probing; no secret exfiltration.
What to do
Build the verify request with URL + searchParams (or encodeURIComponent on both secret and response), and validate the token against ^[A-Za-z0-9._-]{1,2048}$ before use.
Update affected packages to safe versions:
@apostrophecms/form: version 1.5.5 or later@apostrophecms/login-hcaptcha: version 1.3.0 or later@apostrophecms/login-recaptcha: version 1.2.1 or later
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @apostrophecms/form | < 1.5.5 | 1.5.5 |
| npm package | @apostrophecms/login-hcaptcha | < 1.3.0 | 1.3.0 |
| npm package | @apostrophecms/login-recaptcha | < 1.2.1 | 1.2.1 |
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-44qr-rrjg-2cqq
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe
- https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-116- Platform
- npm
- Package
@apostrophecms/form, @apostrophecms/login-hcaptcha, @apostrophecms/login-recaptcha- Disclosed
- 20.10.2026
- Updated
- 20.10.2026 21:25
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-44qr-rrjg-2cqq - CC BY 4.0
Vulnerability history: @apostrophecms/form
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 10.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2026: 2
-
ApostropheCMS: CAPTCHA response token not URL-encoded this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.