Cloudanix VulnDB

GHSA-hg7g-56h5-5pqr

Medium · 5.3

CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

CVSS

5.3

EPSS

—

Published

Apr 14, 2026

CISA due date

—

The record

`objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities