CVE-2026-85602: Grav Form Plugin Auth Bypass Vulnerability

CVE-2026-85602 Overview

CVE-2026-85602 is an authentication bypass vulnerability in the Grav Form plugin (getgrav/grav-plugin-form) affecting versions 8.0.6 through 9.1.19. The plugin selects the reCAPTCHA validation branch based solely on which response field key appears in the submitted payload. An anonymous attacker on a site configured for reCAPTCHA v3 can submit a v3 token under the v2 field name g-recaptcha-response instead of token. This forces validation through the v2 branch, which skips the score threshold and expected action checks. The result is a complete bypass of reCAPTCHA v3 bot protection. The issue is fixed in version 9.1.20.

Critical Impact
Anonymous attackers can bypass reCAPTCHA v3 bot protection on Grav sites, enabling automated abuse of any form protected by the plugin including logins, contact forms, and account registration.

Affected Products

Grav CMS Form plugin (getgrav/grav-plugin-form) version 8.0.6 and later
Grav CMS Form plugin versions up to and including 9.1.19
Grav sites configured to use reCAPTCHA v3 for bot protection

Discovery Timeline

2026-09-04 - CVE-2026-85602 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85602

Vulnerability Analysis

The Grav Form plugin supports both reCAPTCHA v2 and v3 for form protection. reCAPTCHA v2 returns a boolean success value based on user interaction with a challenge. reCAPTCHA v3 returns a score between 0.0 and 1.0 along with an action string, requiring server-side evaluation against a configured threshold and expected action.

The plugin uses the presence of specific field keys in the submitted request to determine which validation branch to execute. If the token key exists, it validates as v3. If the g-recaptcha-response key exists, it validates as v2. The plugin does not confirm that the selected branch matches the site's configured reCAPTCHA version.

On a site configured for reCAPTCHA v3, an attacker who submits a valid v3 token under the field name g-recaptcha-response triggers the v2 branch. The v2 branch treats any Google-verified token as successful without checking the score or action fields returned by the reCAPTCHA API.

Root Cause

The root cause maps to [CWE-807] Reliance on Untrusted Inputs in a Security Decision. The plugin allows client-supplied field naming to select which validation logic runs. An authoritative branch selection should derive from the server-side configuration, not the request payload.

Attack Vector

The attack requires no authentication, no user interaction, and is exploitable over the network. An attacker obtains a valid reCAPTCHA v3 token, either by loading the target page or by using a token farm, then submits form data with that token placed under the g-recaptcha-response field. Automated tooling can submit forms at scale while defeating the score-based scoring that reCAPTCHA v3 provides.

See the GitHub Security Advisory GHSA-89j6-8h38-2cc3 and the Vulncheck Advisory for Grav Plugin for additional technical details.

Detection Methods for CVE-2026-85602

Indicators of Compromise

Form submissions containing the g-recaptcha-response field on sites configured for reCAPTCHA v3
Spikes in successful form submissions from single IP addresses or narrow IP ranges
Elevated volume of account registrations, comment posts, or contact form submissions inconsistent with normal site traffic
Google reCAPTCHA admin console showing high request volume with low average score for the affected site key

Detection Strategies

Inspect web server access logs for POST requests to Grav form endpoints and correlate the presence of g-recaptcha-response in the body when the site is configured for v3
Compare submitted reCAPTCHA field names against the version declared in the plugin configuration file
Monitor Grav plugin version output and flag any host running grav-plugin-form between 8.0.6 and 9.1.19

Monitoring Recommendations

Enable request body logging on the web application firewall in front of Grav to capture form field names
Review the reCAPTCHA admin dashboard weekly for score distribution anomalies on protected site keys
Alert on form submission rates that exceed baseline thresholds per source IP or user agent

How to Mitigate CVE-2026-85602

Immediate Actions Required

Upgrade the Grav Form plugin to version 9.1.20 or later on all Grav installations
Audit all Grav sites for the installed version of getgrav/grav-plugin-form and prioritize public-facing forms
Rotate reCAPTCHA site and secret keys if abuse of protected forms is suspected
Review recent form submissions for automated abuse patterns and remove fraudulent content or accounts

Patch Information

The maintainers fixed the issue in grav-plugin-form version 9.1.20. The patched release enforces branch selection based on the server-side configured reCAPTCHA version rather than the field names present in the submitted payload. Update through the Grav Package Manager (bin/gpm update form) or by installing the release from the plugin repository. Refer to the GitHub Security Advisory GHSA-89j6-8h38-2cc3 for release details.

Workarounds

Disable reCAPTCHA v3 on affected forms and require an alternative anti-automation control until the patch is applied
Deploy a web application firewall rule that rejects form submissions containing the g-recaptcha-response field on endpoints configured for reCAPTCHA v3
Temporarily disable public forms that do not require anonymous access until the plugin is upgraded

bash

# Upgrade the Grav Form plugin via the Grav Package Manager
cd /path/to/grav
bin/gpm update form

# Verify the installed version is 9.1.20 or later
bin/gpm info form | grep -i version