GHSA-p3qj-vw7q-v9pcMediumCVSS 6.5
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that...
🔗 CVE IDs covered (1)
📋 Description
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-49953
- https://karmainsecurity.com/KIS-2026-10
- https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce
- https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set
- https://github.com/advisories/GHSA-p3qj-vw7q-v9pc