WWBN AVideo
CVE-2026-40935
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible with no authentication or user interaction required; integrity impact is low (CAPTCHA bypass enabling form abuse) with no confidentiality or availability effect.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/getCaptcha.php accepts the CAPTCHA length (ql) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive strcasecmp comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on Captcha::validation() (user registration, password recovery, contact form, etc.) in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix.
AnalysisAI
CAPTCHA bypass in WWBN AVideo 29.0 and prior enables unauthenticated attackers to defeat bot protection on user registration, password recovery, and contact form endpoints in at most 33 HTTP requests per session. Two cooperating flaws are responsible: the getCaptcha.php endpoint accepts the word-length parameter directly from the query string without bounds checking, allowing an attacker to force a 1-character CAPTCHA, and failed validation attempts do not invalidate the stored session token, enabling exhaustive brute-forcing of the 33-symbol alphabet. No CISA KEV listing exists, though SSVC rates the attack as automatable with POC-level exploitation, and the effective attack complexity is trivially low regardless of the AC:L CVSS rating.
Technical ContextAI
AVideo is a PHP-based open source self-hosted video platform (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*). The root cause is CWE-804 (Guessable CAPTCHA), arising from two cooperating defects in getCaptcha.php and captcha.php. In getCaptcha.php, the ql (quantity of letters) parameter is read from $_GET with no type coercion, minimum, or upper bound: requesting ql=1 instructs the server to generate a single-character CAPTCHA word stored in the caller's PHP session. In Captcha::validation(), the session token ($_SESSION['palavra']) is only unset on a successful match, not on failure, so an attacker can replay guesses against the same session-bound token indefinitely. The alphabet used is 33 unique case-insensitive characters - A-Z minus O, plus digits 2-9 - meaning a 1-character CAPTCHA is exhaustible in at most 33 requests. The fix in commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 clamps ql to [5, 8] via integer casting and moves token invalidation to unconditionally fire on any validation attempt, regardless of outcome.
RemediationAI
The upstream fix is available in commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 at https://github.com/WWBN/AVideo/commit/bf1c76989e6a9054be4f0eb009d68f0f2464b453; however, no tagged release version incorporating this fix has been independently confirmed - the composer package wwbn/avideo lists the fix version as None, so version-pinned remediation via Composer is not yet verifiable. Operators should apply the commit directly from the repository. As immediate compensating controls: patch objects/getCaptcha.php to enforce integer-cast clamping on ql (minimum 5, maximum 8), and patch objects/captcha.php to unconditionally call unset($_SESSION['palavra']) at the top of the validation method before any comparison, ensuring failed attempts always consume the token. A secondary control is to implement per-session or per-IP rate limiting at the WAF or web server layer on CAPTCHA-protected endpoints, limiting submissions to a small number (e.g., 5) per session - note this may cause friction for legitimate users with poor network stability. Monitor the AVideo GitHub releases page for a tagged version that includes this fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-804 – Guessable CAPTCHA
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today