Vulnerability · Published Jun 15, 2026 · Assigned by VulnCheck
CVE-2026-49953Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set
Medium 6.5
In plain English
A medium-severity security flaw in Discuz! X5.0 from Discuz!. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Discuz! | Discuz! X5.0 | 20260320 – through 20260610 |
Weakness: CWE-804 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://karmainsecurity.com/KIS-2026-10 technical-description
- https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce exploit
- https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set third-party-advisory
- http://seclists.org/fulldisclosure/2026/Jun/4