Medium severity · published Jun 15, 2026
CVE-2026-49953
Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DX
Discuz! X5.0 · Discuz!
20260320 through 20260610 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49953
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49953
karmainsecurity.com
https://karmainsecurity.com/KIS-2026-10
karmainsecurity.com
https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce
www.vulncheck.com
https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set
seclists.org
http://seclists.org/fulldisclosure/2026/Jun/4
More from Discuz! X5.0
9.1
CVE-2026-49952
Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle
7.2
CVE-2026-49954
Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory