---
id: "CVE-2026-124575"
page: "https://infrastack.ai/live/CVE-2026-124575"
kind: "vulnerability"
aliases: ["CVE-2026-124575"]
title: "SiteServer SSCMS: admin login CAPTCHA bypass allows excessive login attempts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cms", "other", "self-hosted", "siteserver-sscms"]
not_affected_if: ["admin-not-internet-exposed"]
published_at: "2026-11-09T07:17:32+00:00"
first_seen_at: "2026-11-09T07:25:05+00:00"
updated_at: "2026-11-09T07:25:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124575", "first_seen_at": "2026-11-09T07:25:05+00:00"}]
exploit_sources: []
---

# SiteServer SSCMS: admin login CAPTCHA bypass allows excessive login attempts

Link for people: https://infrastack.ai/live/CVE-2026-124575 (this .md is for agents)

SiteServer SSCMS, a content management system, fails to restrict repeated admin login attempts when the isForceLogoutAndLogin argument is manipulated. An attacker can make many authentication attempts against the admin login, which the CAPTCHA was meant to limit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SSCMS version against the affected range up to 7.1.3, 7.2.1 and 7.4.0
- Look at src/SSCMS.Web/Controllers/Admin/LoginController.cs for the Submit method handling isForceLogoutAndLogin

## Fix

- A patch exists, referenced as commit df3becb7ebb00a48435418a44fd08a459eb38ace; the fixed version is unknown from the sources

## Timeline

- 2026-11-09T07:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124575

## Documents

- [fix] Patch: github.com https://github.com/siteserver/cms/commit/df3becb7ebb00a48435418a44fd08a459eb38ace

## From the sources

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_