CVE-2025-61635: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-61635 is a vulnerability in the Wikimedia Foundation's ConfirmEdit MediaWiki extension, specifically associated with the includes/FancyCaptcha/ApiFancyCaptchaReload.php file. The issue affects all versions of ConfirmEdit (*) and relates to missing rate limiting on the FancyCaptcha reload API endpoint. It was published on February 3, 2026, and is estimated as HIGH severity by Feedly. The CVSS v4.0 base score is listed as 0.0 (NONE) in the automated scoring, though the provider urgency is rated AMBER and the vulnerability is flagged as automatable, suggesting meaningful real-world risk (Red Hat CVE).

The vulnerability stems from the absence of rate limiting on the ApiFancyCaptchaReload API endpoint in the ConfirmEdit extension's FancyCaptcha module (CWE classification not formally assigned, but consistent with CWE-770: Allocation of Resources Without Limits or Throttling). An unauthenticated, network-accessible attacker can repeatedly call this endpoint to reload CAPTCHA challenges without restriction, enabling automated CAPTCHA-bypass or resource exhaustion attacks. The attack requires no privileges and no special preconditions beyond network access, and the CVSS v4.0 vector confirms it is automatable with active user interaction not required on the server side (Red Hat CVE, Infinitsec Blog).

The primary impact is the effective bypass of CAPTCHA protections on MediaWiki installations using the ConfirmEdit FancyCaptcha module, allowing automated bots to circumvent anti-spam and anti-abuse controls. This can lead to large-scale spam, account creation abuse, or automated form submission attacks on affected wikis. While direct confidentiality or integrity impacts on the server are limited, the degradation of CAPTCHA-based defenses can facilitate downstream abuse at scale (Red Hat CVE, Infinitsec Blog).

The vulnerability is automatable and requires no authentication or privileges, making it straightforward to exploit at scale. The EPSS score is approximately 0.052% (0.000520), indicating a currently low probability of active exploitation in the wild. No public exploit code, exploit kits, or threat actor attribution have been identified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Debian LTS, Debian stable, and Mageia have issued security advisories addressing this issue, suggesting it has received attention from the Linux distribution security community (Red Hat CVE, Debian LTS Announce, Debian Security Announce).

1. Reconnaissance: Identify MediaWiki installations using the ConfirmEdit extension with FancyCaptcha enabled by browsing to pages that trigger CAPTCHA challenges (e.g., account creation, edit submission).
2. Locate the API endpoint: Confirm the presence of the ApiFancyCaptchaReload endpoint, typically accessible at <wiki-base>/api.php?action=fancycaptchareload or equivalent.
3. Automated reload requests: Script repeated unauthenticated HTTP GET/POST requests to the reload endpoint in rapid succession, cycling through new CAPTCHA images without triggering any rate limit or lockout.
4. CAPTCHA solving: Feed the retrieved CAPTCHA images to an automated solver (OCR tool or third-party CAPTCHA-solving service) to obtain valid answers.
5. Abuse downstream functionality: Use the solved CAPTCHAs to automate account creation, spam submissions, or other protected actions on the target wiki at scale (Infinitsec Blog).

• Network: High-volume repeated requests to api.php?action=fancycaptchareload from a single IP or a distributed set of IPs in a short time window; unusual spikes in API traffic to the MediaWiki CAPTCHA reload endpoint.
• Logs: MediaWiki access logs showing hundreds or thousands of requests to the FancyCaptcha reload API endpoint within minutes, particularly from automated user agents or headless browsers.
• Application: Sudden increase in account registrations, spam edits, or form submissions that previously required CAPTCHA completion; CAPTCHA challenges being solved at an abnormally high rate.

The fix involves adding rate limiting to the ApiFancyCaptchaReload API endpoint in the ConfirmEdit extension. Debian has issued security updates for MediaWiki (DSA-6085-1 and DLA-4355-1) and Mageia has released MGASA-2025-0260 addressing this issue. Administrators should update their MediaWiki and ConfirmEdit packages to the patched versions provided by their distribution. As a workaround, site operators can implement web server or reverse proxy-level rate limiting on requests to the api.php?action=fancycaptchareload endpoint (Debian Security Announce, Debian LTS Announce, Mageia Advisory).

Debian and Mageia security teams issued advisories addressing this vulnerability as part of broader MediaWiki security updates. A blog post by a MediaWiki developer (bawolff) discussed the effectiveness of XSS protections in the context of related MediaWiki security work. The RogoLabs GhostCVEs project flagged this CVE in a ghost/low-impact CVE report, suggesting some community skepticism about its severity rating. Overall community reaction has been muted, consistent with the low EPSS score and limited direct server-side impact (Debian Security Announce, bawolff Blog, GhostCVEs Report).