Login Hcaptcha
Monthly
Improperly encoded CAPTCHA response tokens let remote attackers disrupt reCAPTCHA and hCaptcha verification in ApostropheCMS deployments that run the Form add-on before 1.5.5, login-recaptcha before 1.2.1, or login-hcaptcha before 1.3.0. Submitting a token containing '&' plus extra key=value pairs injects parameters into the server-side siteverify request, forcing verification failures that break CAPTCHA-gated forms and logins and enabling automated bypass probing; the vendor assessment confirms no secret disclosure and no proven CAPTCHA bypass. No public exploit has been identified at time of analysis, and CISA KEV or EPSS data does not elevate this above a low-priority, denial-of-service-style nuisance for sites that have a vulnerable add-on installed with CAPTCHA actively enabled.
Improperly encoded CAPTCHA response tokens let remote attackers disrupt reCAPTCHA and hCaptcha verification in ApostropheCMS deployments that run the Form add-on before 1.5.5, login-recaptcha before 1.2.1, or login-hcaptcha before 1.3.0. Submitting a token containing '&' plus extra key=value pairs injects parameters into the server-side siteverify request, forcing verification failures that break CAPTCHA-gated forms and logins and enabling automated bypass probing; the vendor assessment confirms no secret disclosure and no proven CAPTCHA bypass. No public exploit has been identified at time of analysis, and CISA KEV or EPSS data does not elevate this above a low-priority, denial-of-service-style nuisance for sites that have a vulnerable add-on installed with CAPTCHA actively enabled.