Read the docs
TI-2023-24281 Aliases CVE-2023-45292GHSA-5mmw-p5qv-w3x5

Captcha verification bypass in github.com/mojocn/base64Captcha

Priority LOW 24CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.

Why it matters now

EPSS 0.00297 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/mojocn/base64Captcha (github.com/mojocn/base64Captcha): 1.3.6github.com/mojocn/base64Captcha (Go): 1.3.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
github.com/mojocn/base64Captchagithub.com/mojocn/base64Captchabefore 1.3.61.3.6Patch availableCNA
—github.com/mojocn/base64Captcha (Go)before 1.3.61.3.6Patch availableGHSA-5mmw-p5qv-w3x5
  • github.com/mojocn/base64Captcha Vendorgithub.com/mojocn/base64Captcha Affected before 1.3.6 Fixed in 1.3.6 Patch available CNA
  • github.com/mojocn/base64Captcha (Go) Vendor— Affected before 1.3.6 Fixed in 1.3.6 Patch available GHSA-5mmw-p5qv-w3x5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mojotv:base64captcha:*:*:*:*:*:go:*:*before 1.3.6VulnerableMojotv
  • cpe:2.3:a:mojotv:base64captcha:*:*:*:*:*:go:*:* Versions before 1.3.6 Vulnerable ·Mojotv

Remediation

  • Fix · CNA github.com/mojocn/base64Captcha (github.com/mojocn/base64Captcha) Fixed in 1.3.6
  • Fix · GHSA-5mmw-p5qv-w3x5 github.com/mojocn/base64Captcha (Go) Fixed in 1.3.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45292
  2. 2026-10-03 Alias added: GHSA-5mmw-p5qv-w3x5

References

Exploit 1

Patch 2

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences