The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-030 |
|
History
Tue, 20 Oct 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots. | |
| Title | Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha) | |
| Weaknesses | CWE-656 CWE-804 |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: TYPO3
Published:
Updated: 2026-10-20T09:30:54.371Z
Reserved: 2026-10-18T12:08:05.799Z
Link: CVE-2026-112067
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-20T10:17:03.883
Modified: 2026-10-20T10:17:03.883
Link: CVE-2026-112067
Redhat
No data.
OpenCVE Enrichment
No data.