CVE-2026-40935

WWBN AVideo versions 29.0 and prior contain a CAPTCHA bypass vulnerability in the getCaptcha.php endpoint that allows unauthenticated attackers to trivially brute-force CAPTCHA validation on protected endpoints including user registration, password recovery, and contact forms. The vulnerability exists because the CAPTCHA length parameter accepts unsanitized input, enabling attackers to force generation of single-character CAPTCHAs that can be guessed in approximately 33 requests using case-insensitive string comparison. Additionally, failed validation attempts do not consume the stored session token, allowing unlimited brute-force attempts without rate limiting. The vulnerability carries a CVSS 3.1 score of 5.3 (MEDIUM) with a network-based attack vector, low complexity, and no authentication requirement, resulting in integrity impact through unauthorized account access or form submission. The EPSS score of 0.00028 indicates low prevalence in active exploitation relative to other CVEs, though the attack simplicity suggests real-world risk remains present for unpatched instances. There is currently no evidence of active exploitation in the wild, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The issue has been addressed in commit bf1c76989e6a9054be4f0eb009d68f0f2464b453, and organizations running WWBN AVideo should apply patches immediately to eliminate brute-force attack vectors against authentication and submission mechanisms.