WWBN AVideo versions 29.0 and earlier permit any unauthenticated client to provide a CAPTCHA length parameter via the query string without validation, causing the server to generate a single‑character CAPTCHA. The server compares the supplied answer using a case‑insensitive comparison over an alphabet of roughly 33 characters and does not invalidate the stored session token when a validation fails. This combination allows an attacker to brute‑force the correct answer in about 33 attempts per session, enabling the exploitation of any feature that relies on Captcha::validation(), such as user registration, password recovery, or contact forms.

Open source video platform WWBN:AVideo, affected in all releases up to and including version 29.0, where the vulnerability exists in the objects/getCaptcha.php handler.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the flaw is not listed in CISA’s KEV catalog. The attack can be launched from any network location with no authentication, making it relatively easy to exploit in any environment where the vulnerable code is deployed. Attackers can create or access accounts and other privileged operations by repeatedly solving the short CAPTCHA during account‑related activities.