CVE-2025-8546: Pybbs Auth Bypass Vulnerability

CVE-2025-8546 Overview

CVE-2025-8546 is a medium-severity authentication weakness affecting atjiu/pybbs through version 6.0.0. The flaw resides in the adminlogin/login function of the Verification Code Handler component. The captcha value stored in the user session is not invalidated after verification, allowing the same captcha token to be reused across multiple login attempts. This behavior effectively neutralizes the captcha as a brute-force protection mechanism. The issue is remotely exploitable and requires no authentication or user interaction. A public disclosure has been made, and a patch is available under commit hash ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf.

Critical Impact
Remote attackers can reuse a single captcha value to automate credential guessing against the pybbs administrative login endpoint, weakening authentication controls [CWE-287].

Affected Products

atjiu pybbs versions up to and including 6.0.0
pybbs Admin login controller (IndexAdminController.java)
pybbs API login controller (IndexApiController.java)

Discovery Timeline

2025-08-05 - CVE-2025-8546 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8546

Vulnerability Analysis

The vulnerability is an improper authentication issue [CWE-287] in the pybbs forum software. The login controllers read the captcha value from session.getAttribute("_captcha") and compare it to the user-submitted code parameter. The session attribute is never cleared after the comparison completes. An attacker who obtains one valid captcha string can replay it across many login attempts without solving a new challenge. This defeats the anti-automation purpose of the captcha and enables scripted credential guessing against the administrative interface.

Root Cause

The root cause is missing invalidation of the captcha session attribute after use. Once _captcha is set in the HTTP session, both IndexAdminController and IndexApiController compare it to the submitted code but do not call session.removeAttribute("_captcha"). The captcha therefore remains valid for the duration of the session, allowing indefinite reuse.

Attack Vector

An unauthenticated remote attacker requests the login page once to obtain a valid captcha token bound to their session. The attacker then submits repeated POST requests to /admin/login (or the API login endpoint) with different username and password combinations while reusing the same captcha value. Because the server never rotates or removes the token, brute-force and credential-stuffing attacks proceed unimpeded.

java

// Patch excerpt: src/main/java/co/yiiu/pybbs/controller/admin/IndexAdminController.java
// Fix: 修复图形验证码可重复使用的漏洞 (Fix reusable captcha vulnerability)
                              HttpServletRequest request, RedirectAttributes redirectAttributes) {
         String url = WebUtils.getSavedRequest(request) == null ? "/admin/index" : WebUtils.getSavedRequest(request).getRequestUrl();
         String captcha = (String) session.getAttribute("_captcha");
+        session.removeAttribute("_captcha");
         if (captcha == null || StringUtils.isEmpty(code) || !captcha.equalsIgnoreCase(code)) {
             redirectAttributes.addFlashAttribute("error", "验证码不正确");
             redirectAttributes.addFlashAttribute("username", username);

Source: pybbs security patch commit

The fix adds session.removeAttribute("_captcha") immediately after reading the stored value, ensuring the token is consumed on a single verification attempt. The same fix is applied to the API login handler in IndexApiController.java.

Detection Methods for CVE-2025-8546

Indicators of Compromise

Repeated POST requests to /admin/login or the API login endpoint from a single source IP with varying username or password fields.
Multiple failed login events sharing an identical JSESSIONID cookie and identical captcha code parameter values.
Elevated authentication failure counts on pybbs administrative endpoints outside normal operator hours.

Detection Strategies

Enable and centralize pybbs application access logs, then correlate failed logins by session identifier to expose captcha replay behavior.
Alert when the same captcha code value appears in more than one login POST for a given session within a short time window.
Baseline typical admin login volume and flag statistical spikes that indicate automated guessing.

Monitoring Recommendations

Forward web server and application logs to a centralized logging or SIEM platform for retention and analytical queries.
Monitor authentication outcomes on /admin/login for high failure-to-success ratios per session or per source IP.
Track abnormal user-agent strings and request timing intervals consistent with scripted brute-force tools.

How to Mitigate CVE-2025-8546

Immediate Actions Required

Apply the upstream fix at commit ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf and rebuild the application from source.
Rotate any administrative passwords that may have been exposed to automated guessing prior to patching.
Restrict network access to the /admin/ path to trusted management networks or via VPN until patching is complete.

Patch Information

The maintainer of atjiu/pybbs has published a fix that invalidates the captcha session attribute after verification in both IndexAdminController.java and IndexApiController.java. Upgrade to a build that includes commit ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf. Additional context is available in GitHub Issue #199 and VulDB entry #318675.

Workarounds

Deploy a Web Application Firewall (WAF) rule to rate-limit POST requests to the pybbs login endpoints per IP and per session.
Enforce account lockout on the administrative account after a small number of failed attempts as a compensating control.
Terminate and regenerate sessions after each login attempt to force clients to fetch a new captcha on every submission.

bash

# Example nginx rate limiting for pybbs admin login endpoint
http {
    limit_req_zone $binary_remote_addr zone=pybbs_login:10m rate=5r/m;

    server {
        location = /admin/login {
            limit_req zone=pybbs_login burst=3 nodelay;
            proxy_pass http://pybbs_backend;
        }
    }
}