CVE-2023-45292
Captcha verification bypass in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
- Record
CVE-2023-45292- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
CVE List No score
Captcha verification bypass in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
- Record
CVE-2023-45292- Updated
- 2026-11-02
EUVDEUVD-2023-3117 No score
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
- Record
EUVD-2023-3117- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5mmw-p5qv-w3x5
Always incorrect control flow in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
- Record
GHSA-5mmw-p5qv-w3x5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-345, CWE-670
- Updated
- 2026-11-02
OSVGHSA-5mmw-p5qv-w3x5
Always incorrect control flow in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
- Record
GHSA-5mmw-p5qv-w3x5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-345, CWE-670
- Updated
- 2026-11-02
OSV No score
Captcha verification bypass in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
- Record
CVE-2023-45292- Updated
- 2026-11-02
OSVGO-2023-2386 No score
Captcha verification bypass in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed.
For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
- Record
GO-2023-2386- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mojocn/base64CaptchaGo |
before 1.3.6 | 1.3.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-45292 is a medium vulnerability (CVSS 5.3) in Github.com/mojocn/base64captcha, published December 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in github.com/mojocn/base64Captcha 1.3.6.
References
github.com/mojocn/base64Captcha/issues/120
pkg.go.dev/vuln/GO-2023-2386
nvd.nist.gov/vuln/detail/CVE-2023-45292