Vulnerability Description
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://karmainsecurity.com/KIS-2026-10
- https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce
- https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-
- http://seclists.org/fulldisclosure/2026/Jun/4
FAQ
What is CVE-2026-49953?
CVE-2026-49953 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and p...
How severe is CVE-2026-49953?
CVE-2026-49953 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49953?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.