CVE-2026-49953
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Jun 15, 2026
CISA due date
—
The record
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-40935 WWBN AVideo is an open source video platform. CWE-804
- GHSA-hg7g-56h5-5pqr CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token… CWE-804
- CVE-2025-70129 If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled… CWE-804
- CVE-2026-27411 Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Plugin siteguard allows… CWE-804