CVE-2026-40935: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-40935 Overview

WWBN AVideo, an open source video platform, contains a critical CAPTCHA bypass vulnerability in versions 29.0 and prior. The vulnerability exists in objects/getCaptcha.php, which accepts the CAPTCHA length parameter (ql) directly from the query string without any validation, clamping, or sanitization. This allows any unauthenticated attacker to force the server to generate a single-character CAPTCHA, dramatically reducing the security of CAPTCHA-protected endpoints.

Critical Impact

Attackers can trivially brute-force CAPTCHA protection on user registration, password recovery, and contact forms in approximately 33 requests per session, enabling automated account creation, credential harvesting, and spam campaigns.

Affected Products

• WWBN AVideo versions 29.0 and prior
• All installations using the vulnerable objects/getCaptcha.php endpoint
• Any endpoint relying on Captcha::validation() (registration, password recovery, contact forms)

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40935 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40935

Vulnerability Analysis

This vulnerability represents an Input Validation Error (CWE-804: Guessable CAPTCHA) that fundamentally undermines the security purpose of CAPTCHA protection. The flaw stems from the application's trust of user-supplied input for a critical security parameter without any boundary enforcement.

The vulnerable getCaptcha.php script directly accepts the ql (quantidade_letras/quantity of letters) parameter from the query string and passes it to the CAPTCHA generation class. When an attacker supplies ql=1, the server generates a CAPTCHA with only a single character drawn from an approximately 33-character alphabet (case-insensitive letters and numbers).

Combined with two additional weaknesses—case-insensitive comparison via strcasecmp and the failure to invalidate session tokens on incorrect attempts—an attacker can systematically enumerate all possible CAPTCHA values. Since failed validation attempts do not consume or rotate the stored session token, the same CAPTCHA can be attacked repeatedly until the correct value is guessed.

Root Cause

The root cause is the absence of input validation and boundary enforcement on the CAPTCHA length parameter. The vulnerable code directly used user-supplied values:

$quantidade_letras = empty($_GET['ql']) ? 5 : $_GET['ql'];

This allows any value to be passed, including 1, which reduces the CAPTCHA to a trivially guessable single character. Additionally, the original code used str_shuffle() for character selection, which relies on PHP's internal random number generator that may not be cryptographically secure.

Source: GitHub AVideo Commit

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Requesting a CAPTCHA image with ql=1 to generate a single-character CAPTCHA
2. Iterating through the ~33 possible character values (case-insensitive)
3. Submitting each guess without penalty since failed attempts don't invalidate the session
4. Successfully bypassing CAPTCHA protection in at most 33 requests

The fix implements proper input clamping with minimum and maximum bounds:

// Vulnerable code (before fix)
$quantidade_letras = empty($_GET['ql']) ? 5 : $_GET['ql'];

// Fixed code (after patch)
$largura       = isset($_GET['l'])  ? max(80,  min(400, (int)$_GET['l']))  : 120;
$altura        = isset($_GET['a'])  ? max(20,  min(200, (int)$_GET['a']))  : 40;
$tamanho_fonte = isset($_GET['tf']) ? max(10,  min(40,  (int)$_GET['tf'])) : 18;
$quantidade_letras = isset($_GET['ql']) ? max(5, min(8, (int)$_GET['ql'])) : 5;

Source: GitHub AVideo Commit

The patch also improves the random character selection by replacing str_shuffle() with random_int():

// Vulnerable code (before fix)
$palavra = substr(str_shuffle($letters), 0, ($this->quantidade_letras));

// Fixed code (after patch)
$len = strlen($letters);
$palavra = '';
for ($j = 0; $j < $this->quantidade_letras; $j++) {
    $palavra .= $letters[random_int(0, $len - 1)];
}

Source: GitHub AVideo Commit

Detection Methods for CVE-2026-40935

Indicators of Compromise

• HTTP requests to objects/getCaptcha.php with ql=1 or other low values in query parameters
• Unusually high volume of requests to CAPTCHA-protected endpoints from single IP addresses
• Multiple failed form submissions followed by successful submissions in rapid succession
• Automated user registration patterns or mass account creation
• Spike in password reset requests across multiple accounts

Detection Strategies

• Monitor web server access logs for requests containing getCaptcha.php?ql= with values less than 5
• Implement rate limiting rules to detect rapid sequential requests to CAPTCHA validation endpoints
• Deploy web application firewall (WAF) rules to block or alert on suspicious ql parameter values
• Configure intrusion detection systems to identify brute-force patterns against form endpoints

Monitoring Recommendations

• Enable detailed logging for all CAPTCHA generation and validation requests
• Set up alerts for anomalous request rates to registration and password recovery endpoints
• Monitor for automated tool signatures in User-Agent strings targeting AVideo installations
• Track failed CAPTCHA validation attempts per session and per IP address

How to Mitigate CVE-2026-40935

Immediate Actions Required

• Update WWBN AVideo to the latest version containing commit bf1c76989e6a9054be4f0eb009d68f0f2464b453
• Implement server-side rate limiting on all CAPTCHA-protected endpoints
• Deploy WAF rules to reject requests with ql parameter values outside the range of 5-8
• Review logs for evidence of prior exploitation attempts
• Consider adding additional bot protection mechanisms such as reCAPTCHA or hCaptcha

Patch Information

The vulnerability is fixed in commit bf1c76989e6a9054be4f0eb009d68f0f2464b453. The patch implements proper input validation with minimum and maximum bounds for all CAPTCHA parameters:

• Width (l): clamped between 80-400 pixels
• Height (a): clamped between 20-200 pixels
• Font size (tf): clamped between 10-40
• Letter count (ql): clamped between 5-8 characters

Additionally, the patch replaces the insecure str_shuffle() function with cryptographically secure random_int() for character selection.

For detailed patch information, see the GitHub Security Advisory GHSA-hg7g-56h5-5pqr.

Workarounds

• Apply the manual patch from the GitHub commit if immediate upgrade is not possible
• Implement server-level restrictions using nginx or Apache to enforce minimum CAPTCHA length parameters
• Add IP-based rate limiting to prevent brute-force attempts
• Deploy a reverse proxy with bot detection capabilities in front of the AVideo installation
• Consider temporarily disabling public registration if exploitation is detected

# Nginx configuration to block low CAPTCHA length values
location ~ /objects/getCaptcha\.php {
    if ($arg_ql ~ "^[1-4]$") {
        return 403;
    }
    # Rate limiting
    limit_req zone=captcha burst=5 nodelay;
}