WWBN AVideo CVE-2026-40935

No special server configuration is required - the vulnerability is present in any default AVideo 29.0 or prior deployment that has CAPTCHA-protected endpoints enabled (user registration, password recovery, or contact form). The attacker must be able to establish a PHP session with the server (unauthenticated, requires only network access) and issue HTTP GET requests to /objects/getCaptcha.php with the ql=1 parameter before submitting to a CAPTCHA-validated endpoint. The primary limiting factor is per-session scope: each brute-force attempt requires a fresh CAPTCHA generation step, but since session creation itself requires no authentication, this is not a meaningful barrier. Exploitation is bounded only by the 33-symbol alphabet when ql=1, giving a deterministic worst-case of 33 requests per target action.

The CVSS 3.1 score of 5.3 (Medium) correctly captures the narrow integrity impact: the vulnerability does not directly expose data or crash the server but removes the only bot-protection layer from several sensitive endpoints. The EPSS score of 0.03% (8th percentile) suggests low observed exploitation probability at time of analysis, likely reflecting AVideo's limited deployment scale rather than genuine attack difficulty. In contrast, the SSVC decision framework independently rates the attack as automatable with POC-level exploitation, which is consistent with the code evidence - the attack requires no specialized tooling, no authentication, and fewer than 33 HTTP requests per session. Real-world risk concentrates on account takeover via automated password reset, bulk spam registrations, and contact form abuse. There is no CVSS/description conflict: the network vector, low complexity, and no-privilege ratings are all consistent with the actual exploit mechanics. The key limiting factor is deployment prevalence - AVideo is a niche self-hosted platform, constraining the aggregate attack surface compared to a similar flaw in a ubiquitous product.

An unauthenticated attacker targeting the AVideo password recovery form sends a single request to /objects/getCaptcha.php?ql=1 within their session, causing the server to store a one-character token drawn from a 33-symbol alphabet. The attacker then submits password reset requests iterating through all 33 possible characters in the CAPTCHA field; because failed attempts leave the session token intact, the correct character is found within 33 requests and CAPTCHA validation passes, enabling automated account takeover. No POC tool has been publicly released, but the attack is fully reproducible with any scripted HTTP client given the advisory's technical detail.