CVE-2026-49953 — Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting l…
Published: 2026-06-15 · CVSS: 6.9 · CVSS 4.0
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7