{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "@apostrophecms login-recaptcha: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apostrophecms--login-recaptcha/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apostrophecms--login-recaptcha/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113667/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113667/",
   "title": "CVE-2026-113667 · apostrophecms apostrophe · disclosed",
   "content_text": "ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.",
   "date_published": "2026-10-20T17:33:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-113667/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-113667/",
   "title": "CVE-2026-113667 · apostrophecms apostrophe · fixed upstream (npm)",
   "content_text": "Fixed versions: @apostrophecms/form 1.5.5, @apostrophecms/login-hcaptcha 1.3.0, @apostrophecms/login-recaptcha 1.2.1.",
   "date_published": "2026-10-20T17:33:28Z"
  }
 ]
}