Authentication Bypass in AVideo Open Source Video Platform

CVE-2026-40935

What is CVE-2026-40935?

AVideo, an open-source video platform, has a vulnerability where the CAPTCHA generation process can be exploited by unauthenticated clients. The 'objects/getCaptcha.php' script accepts a CAPTCHA length parameter directly from the query string without proper sanitization or restrictions. This flaw allows attackers to request a 1-character CAPTCHA, leading to a trivial brute force attack on endpoints that depend on the captcha validation process, such as user registration and password recovery. As the system does not consume the session token upon failed validation attempts, attackers can succeed in bypassing CAPTCHA protections within approximately 33 requests. A fix has been implemented in the latest version to address this issue.

References