CVE-2025-61635

N/A Unknown
Authentication Bypass

📋 TL;DR

This vulnerability in Wikimedia Foundation's ConfirmEdit extension allows attackers to bypass CAPTCHA protection mechanisms. It affects all installations using the FancyCaptcha module via the ApiFancyCaptchaReload.php endpoint. This impacts any Wikimedia-based site (like MediaWiki) that relies on ConfirmEdit for spam prevention.

💻 Affected Systems

Products:
  • Wikimedia ConfirmEdit extension
Versions: * (all versions)
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects installations using FancyCaptcha module. ConfirmEdit must be enabled and configured to use FancyCaptcha.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete bypass of CAPTCHA protection allowing automated spam, account creation, or content submission without human verification

🟠

Likely Case

Automated bots bypassing CAPTCHA to post spam content or create fake accounts

🟢

If Mitigated

Limited spam attempts that can be caught by additional security layers

🌐 Internet-Facing: HIGH
🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

The vulnerability is in an API endpoint that handles CAPTCHA reloading, making it accessible to unauthenticated users. Simple HTTP requests can trigger the bypass.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check latest ConfirmEdit extension version

Vendor Advisory: https://phabricator.wikimedia.org/T355073

Restart Required: No

Instructions:

1. Update ConfirmEdit extension to latest version
2. Apply security patches from Wikimedia
3. Verify FancyCaptcha functionality after update

🔧 Temporary Workarounds

Disable FancyCaptcha

all

Temporarily switch to alternative CAPTCHA method or disable CAPTCHA protection

Edit LocalSettings.php: $wgCaptchaClass = 'SimpleCaptcha';

Restrict API Access

all

Limit access to the vulnerable API endpoint

Add IP restrictions or authentication requirements for api.php endpoints

🧯 If You Can't Patch

  • Implement rate limiting on form submissions
  • Add additional spam filtering layers (Akismet, manual moderation)

🔍 How to Verify

Check if Vulnerable:

Check if ConfirmEdit extension is installed and FancyCaptcha is enabled in LocalSettings.php

Check Version:

Check extension version in MediaWiki Special:Version page

Verify Fix Applied:

Test CAPTCHA functionality - automated submissions should be blocked

📡 Detection & Monitoring

Log Indicators:

  • Unusual API calls to ApiFancyCaptchaReload
  • Spike in form submissions without CAPTCHA verification
  • Multiple failed CAPTCHA attempts from same IP

Network Indicators:

  • Repeated POST requests to api.php with captcha parameters
  • Unusual traffic patterns to CAPTCHA endpoints

SIEM Query:

source="apache_logs" AND uri="/api.php" AND params CONTAINS "FancyCaptchaReload"

📊 Metadata

CVE ID: CVE-2025-61635
CVSS v3 Score: N/A (Unknown)
Published: February 3, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This