{"id":"CVE-2022-24880","aliases":["EUVD-2022-0105","GHSA-7r87-cj48-wj45","PYSEC-2022-193"],"status":"published","title":"Potential Captcha Validate Bypass in flask-session-captcha","description":"flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01206,"percentile":0.68541,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-253","CWE-394","CWE-754"],"published":"2022-04-25T22:10:13Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"PyPI","package":"flask-session-captcha","fixed_in":["1.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"flask-session-captcha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"flask-session-captcha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"flask-session-captcha","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"2811ae23a38d33b620fb7a07de8837c6d65c13e4"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0"]}],"products":[{"vendor":"flask-session-captcha_project","product":"flask-session-captcha"},{"vendor":"tethik","product":"flask-session-captcha"}],"references":[{"url":"https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/Tethik/flask-session-captcha/pull/27","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24880","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-session-captcha/PYSEC-2022-193.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7r87-cj48-wj45"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24880.json","tags":["advisory"]},{"url":"https://github.com/Tethik/flask-session-captcha","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-24880","title":"Potential Captcha Validate Bypass in flask-session-captcha","description":"flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.","status":"published","published":"2022-04-25T22:10:13Z","modified":"2025-04-23T18:32:31.559Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-253","CWE-394","CWE-754"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-0105","description":"flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.","status":"published","published":"2022-04-25T22:10:13Z","modified":"2025-04-23T18:32:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:08.401317Z"}],"ghsa":[{"id":"GHSA-7r87-cj48-wj45","title":"Potential Captcha Validate Bypass in flask-session-captcha","description":"### Impact\nflask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session.\n\nThe `captcha.validate()` function would return `None` if passed no value (e.g. by submitting a request with an empty form).\n\nIf implementing users were checking the return value to be **False**, the captcha verification check could be bypassed.\n\nSample vulnerable code:\n```python\nif captcha.validate() == False:\n    ... # abort\nelse:\n   ... # do stuff\n```\n\n### Patches\nA new version (1.2.1) is available that fixes the issue.\n\n### Workarounds\nUsers can workaround the issue by not explicitly checking that the value is False. \n\nChecking the return value less explicitly should still work. \n\n```python\nif not captcha.validate():\n    ... # abort\nelse:\n   ... # do stuff\n```\n\n```python\nif captcha.validate():\n    ... # do stuff\nelse:\n   ... # abort\n```\n\n### References\nhttps://github.com/Tethik/flask-session-captcha/pull/27\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the github repo](https://github.com/Tethik/flask-session-captcha)\n","status":"published","published":"2022-04-26T21:19:52Z","modified":"2024-09-20T21:03:07Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-253","CWE-394","CWE-754"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2022-24880","description":"flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.","status":"published","published":"2022-04-25T22:15:43.883Z","modified":"2026-06-17T04:32:43.14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-253","CWE-394","CWE-754"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"CVE-2022-24880","title":"Potential Captcha Validate Bypass in flask-session-captcha","description":"flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.","status":"published","published":"2022-04-25T22:10:13Z","modified":"2026-10-28T02:30:50.73479029Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-253","CWE-394","CWE-754"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"GHSA-7r87-cj48-wj45","title":"Potential Captcha Validate Bypass in flask-session-captcha","description":"### Impact\nflask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session.\n\nThe `captcha.validate()` function would return `None` if passed no value (e.g. by submitting a request with an empty form).\n\nIf implementing users were checking the return value to be **False**, the captcha verification check could be bypassed.\n\nSample vulnerable code:\n```python\nif captcha.validate() == False:\n    ... # abort\nelse:\n   ... # do stuff\n```\n\n### Patches\nA new version (1.2.1) is available that fixes the issue.\n\n### Workarounds\nUsers can workaround the issue by not explicitly checking that the value is False. \n\nChecking the return value less explicitly should still work. \n\n```python\nif not captcha.validate():\n    ... # abort\nelse:\n   ... # do stuff\n```\n\n```python\nif captcha.validate():\n    ... # do stuff\nelse:\n   ... # abort\n```\n\n### References\nhttps://github.com/Tethik/flask-session-captcha/pull/27\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the github repo](https://github.com/Tethik/flask-session-captcha)\n","status":"published","published":"2022-04-26T21:19:52Z","modified":"2025-02-21T05:28:13.664287Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-253","CWE-394","CWE-754"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"PYSEC-2022-193","description":"flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.","status":"published","published":"2022-04-25T22:15:00Z","modified":"2023-11-08T04:08:39.356991Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}