Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

WWBN AVideo CAPTCHA can be easily bypassed in versions 29.0 and earlier

CVE-2026-40935 · published 6 months ago
Summary

If you're using WWBN AVideo versions 29.0 or earlier, an attacker could potentially bypass the CAPTCHA check on your website, which is used for user registration, password recovery, and contact forms. This could allow unauthorized access to your site. To fix this, update to the latest version, which includes a patch to prevent this issue.

Original advisory text
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization,...
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-804Guessable CAPTCHA
Timeline
Published21 Apr 2026
Updated4 Nov 2026
First seen21 Apr 2026
Sources
CVE-2026-40935 · NVD
Track software like this
Free during beta