Medium 6.5Published Jun 15, 2026

CVE-2026-49953Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set

Updated under an hour ago (Oct 27, 2026, 8:50 AM ET)

Does this affect you?

It affects Discuz! X5.0. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Discuz! X5.0

Exploited in the last 30 days

Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-804
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Jul 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Discuz! Discuz! X5.0 discuz:x5.0 (from the name)	from 20260320 through 20260610	CNA record

References

References

https://karmainsecurity.com/KIS-2026-10	technical-description
https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce	exploit
https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set	third-party-advisory
http://seclists.org/fulldisclosure/2026/Jun/4

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.