CVE-2026-85602 Details
Description
The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 field name (g-recaptcha-response instead of token), causing validation to use the v2 branch, which never applies the score threshold or verifies the expected action. This results in a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.
A vulnerability in the Grav Form plugin, specifically in versions 8.0.6 through 9.1.19, allows for an authentication bypass in reCAPTCHA v3. The issue arises because the plugin determines which reCAPTCHA version to use for validation based solely on the response field key present in the submitted form data. On sites configured for reCAPTCHA v3, an anonymous attacker can exploit this by placing a v3 token under the v2 field name, effectively tricking the validation process. This manipulation causes the v2 branch to be used, which does not apply the necessary score threshold or verify the expected action, leading to a complete bypass of reCAPTCHA v3's bot protection.
Users can update the Grav Form plugin to version 9.1.20, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-89j6-8h38-2cc3 | CISA-ADP | AdvisoryTechnical AnalysisVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-89j6-8h38-2cc3 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.20-recaptcha-v3-authentication-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Form | >= 8.0.6, <= 9.1.19 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 5, 2026 | CVE Modified | [email protected] |
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |