---
id: "CVE-2026-126993"
page: "https://infrastack.ai/live/CVE-2026-126993"
kind: "vulnerability"
aliases: ["CVE-2026-126993"]
title: "SiteServer SSCMS: captcha endpoint uses weak encryption on its Value argument"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "siteserver", "sscms"]
not_affected_if: ["sscms-above-7.2.2"]
published_at: "2026-11-12T13:17:15+00:00"
first_seen_at: "2026-11-12T13:38:24+00:00"
updated_at: "2026-11-12T13:38:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126993", "first_seen_at": "2026-11-12T13:38:24+00:00"}]
exploit_sources: []
---

# SiteServer SSCMS: captcha endpoint uses weak encryption on its Value argument

Link for people: https://infrastack.ai/live/CVE-2026-126993 (this .md is for agents)

SiteServer SSCMS up to 7.2.2 has a flaw in the /api/v1/captcha endpoint where the Value argument is protected with inadequate encryption strength. A remote attacker can exploit it, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SSCMS version and see whether it is `7.2.2` or earlier.
- Look for the `/api/v1/captcha` route in your deployment.

## Timeline

- 2026-11-12T13:38:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126993

## From the sources

A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_