Guessable CAPTCHA The advisory has been revoked - it doesn't affect any version of package wwbn/avideo (opens in a new tab)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-WWBNAVIDEO-16069572
- published15 Apr 2026
- disclosed14 Apr 2026
- creditoffset
Introduced: 14 Apr 2026
CVE NOT AVAILABLE CWE-804 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Amendment
This was deemed not a vulnerability.
Overview
wwbn/avideo is an Audio and Video Platform or simply "A Video Platform".
Affected versions of this package are vulnerable to Guessable CAPTCHA through the getCaptcha.php process, which allows external control over the CAPTCHA length parameter without proper validation. An attacker can bypass CAPTCHA protections by repeatedly submitting guesses, as failed attempts do not invalidate the session token, enabling brute-force attacks on endpoints that rely on CAPTCHA validation.