CVE-2026-49953: Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49953?
The severity of CVE-2026-49953 is rated medium with a CVSS score of 6.5.
How do I fix CVE-2026-49953?
To fix CVE-2026-49953, update to a patched version of Discuz! X5.0 released after the specified vulnerable versions.
What are the implications of CVE-2026-49953?
CVE-2026-49953 allows unauthenticated remote attackers to bypass CAPTCHA protections, potentially enabling further exploitation.
Which versions of Discuz! are affected by CVE-2026-49953?
Discuz! X5.0 versions released between 20260320 and 20260501 are affected by CVE-2026-49953.
What type of vulnerability is CVE-2026-49953?
CVE-2026-49953 is a CAPTCHA bypass vulnerability that exploits the predictability of character sets in generated CAPTCHA images.