CVE-2026-49953: Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-15 · updated 2026-10-25
Weakness: CWE-804

Description

Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.

Affected products

Discuz! X5.0: from 20260320 through 20260610

References

https://karmainsecurity.com/KIS-2026-10
https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce
https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set
http://seclists.org/fulldisclosure/2026/Jun/4

Get alerted when CVE-2026-49953 or the next vulnerability affects your stack