CVE-2026-40935
CVE-2026-40935 is a medium-severity vulnerability in Wwbn Avideo with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-804.
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- EPSS exploit prediction: 0% (12th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-24527
- Weakness: CWE-804
- Affected product: Wwbn Avideo
- Published:
- Last modified:
Description
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix.
Frequently asked questions
- What is CVE-2026-40935?
- WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix.
- How severe is CVE-2026-40935?
- CVE-2026-40935 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
- Is CVE-2026-40935 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-40935?
- CVE-2026-40935 affects Wwbn Avideo. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-40935?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-40935 have an EU (EUVD) identifier?
- Yes. CVE-2026-40935 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-24527.
- When was CVE-2026-40935 published?
- CVE-2026-40935 was published on 2026-04-21 and last updated on 2026-06-17.
References
- https://github.com/WWBN/AVideo/commit/bf1c76989e6a9054be4f0eb009d68f0f2464b453
- https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr
Affected products (1)
- cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
More vulnerabilities in Wwbn Avideo
- CVE-2026-40911 — Critical (CVSS 10.0): WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server…
- CVE-2026-33478 — Critical (CVSS 10.0): WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in…
- CVE-2022-30547 — Critical (CVSS 9.9): A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master…
- CVE-2026-41304 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the…
- CVE-2026-33770 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method…
- CVE-2026-33352 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability…
All CVEs affecting Wwbn Avideo →
Other CWE-804 vulnerabilities
- CVE-2026-49953 — Medium (CVSS 6.5): Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated…
- CVE-2026-27411 — Medium (CVSS 5.4): Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Plugin siteguard allows Functionality Bypass.This issue…
- CVE-2025-70129 — Medium (CVSS 5.3): If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is…
- CVE-2025-1262 — Medium (CVSS 5.3): The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including,…
- CVE-2024-31295 — Medium (CVSS 5.3): Guessable CAPTCHA vulnerability in BestWebSoft Captcha by BestWebSoft allows Functionality Bypass.This issue affects…
- CVE-2024-30540 — Medium (CVSS 5.3): Guessable CAPTCHA vulnerability in Guido VS Contact Form allows Functionality Bypass.This issue affects VS Contact…