CVE-2026-39772: CWE-290 Authentication Bypass by Spoofing in bestwebsoft Captcha by BestWebSoft

This vulnerability (CVE-2026-39772) in Captcha by BestWebSoft (versions <= 5.2.8) is classified under CWE-290 (Authentication Bypass by Spoofing). It enables unauthenticated attackers to bypass authentication controls, potentially allowing unauthorized actions that require authentication. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No official patch or vendor advisory details are available at this time.

The vulnerability allows attackers to bypass authentication mechanisms without credentials, which could lead to unauthorized actions or changes that affect the integrity of the system. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.