CVE-2026-85602

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

EUVD-2026-71025

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

CVE-2026-85602

CVE-2026-85602 affects the Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 . The plugin selects which reCAPTCHA validation branch to execute based solely on the field key present in the submitted payload. On a site configured for reCAPTCHA v3 , an unauthenticated attacke...

recaptcha

설명 이 저장소는 Google의 안티봇reCAPTCHA에 대한 기술적 분석을 담고 있으며, 다음을 중점적으로 다룹니다: 페이로드 구조 및 값 핑거프린팅 기법 난독화 기법 안티 디버깅/변조 방지 기법 가상 머신 연락처 Discord: @grecaptcha Telegram: @lyxlobyx 난독화 기법 reCAPTCHA는 가장 정교한 난독화 기법을 사용하는 안티봇 시스템 중 하나로, 코드를 덜 읽기 쉽게 만들고 리버스 엔지니어링을 더욱 어렵게 만드는 일련의 변환을 적용합니다. 대부분의 난독화는 ASTAbstract Syntax...

recaptcha-phish

reCAPTCHA Phish John Hammond | September 13, 2024 이것은 2024년 8월/9월경 실제 유포 환경에서 발견된 사회공학 및 피싱 미끼를 재현하기 위한 작은 하네스입니다. 🪝 실제 유포된 미끼 원래 "사람인지 확인"이라는 위장으로 발견되었으며, 공격 벡터는 복사 및 붙여넣기입니다. 말 그대로 사용자에게 Win+R 단축키로 Windows 실행 대화 상자를 열게 한 다음, 웹 브라우저가 미리 클립보드에 복사해 둔 악성 명령을 Ctrl+V로 붙여넣도록 지시합니다. 이것이... 바보같은... 방법이긴...

uncaptcha

uncaptcha Defeating Google's audio reCaptcha system with 85% accuracy. Disclaimer unCaptcha is intended to be a proof of concept. As of the time of our paper, we found it to successfully solve reCaptcha's audio challenges with 85% success. Since that time, reCaptcha appears to include some...

uncaptcha

uncaptcha Победа над системой аудио reCaptcha от Google с точностью 85%. Disclaimer unCaptcha предназначен для доказательства концепции. По состоянию на момент нашего доклада, мы обнаружили, что он успешно решает аудио-задачи reCaptcha с 85% успеха. С того времени reCaptcha, похоже, включает...

BIT-KEYCLOAK-2026-16104 Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

puppeteer-extra

puppeteer-extra 이곳은 puppeteer-extra를 위한 모노레포입니다. puppeteer를 위한 모듈형 플러그인 프레임워크입니다. :- 🌟 주요 문서는puppeteer-extra 패키지를 참조하세요. 또한 최근 Playwright 지원도 도입했습니다. 관심이 있다면 playwright-extra를 확인해 보세요...

GoogleRecaptchaBypass

Google Recaptcha Solver We love bots ❤️, but Google doesn't. So, here is the solution to bypass Google reCAPTCHA. Solve Google reCAPTCHA less than 5 seconds! 🚀 This is a Python script to solve Google reCAPTCHA using the DrissionPage library. Selenium implementation will be added soon. Recent...

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Summary The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending 10 requests per minute from one IP exhausts the shared bucket and caus...

CVE-2026-16104 Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

CVE-2026-16104 Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

CVE-2026-16104

CVE-2026-16104 affects the authentication configuration endpoint in the Keycloak services used by Red Hat Build of Keycloak. The underlying issue is that the system does not mask sensitive configuration values (e.g., reCAPTCHA secrets) when requested by administrators with view-only permissions, ...

CVE-2026-16104

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

PT-2026-60800

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the authentication configuration endpoint of the keycloak-services component, the core engine for Red Hat Build of Keycloak identity and access management...

Information Exposure

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in...

CVE-2026-57365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hitesh Chandwani reCAPTCHA v2 & v3 for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA v2 & v3 for Asgaros Forum: from n/a through = 1.1.0...

CVE-2026-57365 WordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hitesh Chandwani reCAPTCHA v2 & v3 for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA v2 & v3 for Asgaros Forum: from n/a through = 1.1.0...