GD::SecurityImage versions up to 1.75 generate the CAPTCHA challenge text by sampling from an array using Perl's built-in rand function. The rand function is not cryptographically secure; it is deterministic and can be reproduced, meaning an attacker could anticipate or reverse the challenge string. Consequently, the CAPTCHA can be broken, allowing automated attacks to bypass validation and potentially compromise application security. The weakness is classified as CWE‑338, indicating a flaw in the generation of random secrets, and CWE‑804, signifying a failure to properly validate or sanitize user input.

The vulnerability affects the Perl module BURAK:GD::SecurityImage, version 1.75 and earlier. Since the module has not been updated since 2018 and the repository is archived, any installation of this module remains vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is a remote web application that presents a CAPTCHA to enforce human interaction, where an attacker could replay or predict the challenge to automate credential or form submissions. This would not require local code execution but could lead to loss of availability or data integrity by bypassing input controls.