Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE published June 15, 2026 reading time 31 minutes Modern web application security research is rarely about finding a single “silver bullet” vulnerability that grants instant access. Instead, it’s often about the patient art of vulnerability chaining : connecting seemingly minor security flaws, logical inconsistencies, and timing issues to build a path toward a critical impact. In this blog post, we will explore a complete exploit chain targeting Discuz! X5.0 , the latest version of one of the most popular Internet forum platforms in the world (particularly in China). What started as a curious look into its session management and input validation eventually evolved into a pre-authentication Remote Code Execution ( RCE ) attack! The journey to full system compromise involved several “ingredients”: A Cross-Context Token Reuse vulnerability that can be abused to exploit a Race Condition within the database export/import logic, ultimately leading to an Authentication Bypass. The use of a custom OCR model (or rather, a neural network based on a CNN + LSTM + CTC architecture) to reliably bypass the platform’s CAPTCHA systems during the automated exploitation phases. A Local File Inclusion ( LFI ) vulnerability in the administrative plugin management interface, which served as our final gateway to execute arbitrary code on the web server. By combining these bugs, we will see how an unauthenticated attacker can go from an anonymous visitor to gaining full control over an affected Discuz! X5.0 installation, and likely Discuz! X5.1 (Business Edition) as well, effectively proving that even the most “secure” platforms can fall when multiple small cracks are exploited in the right order. Last Saturday I also had the pleasure of talking publicly about these vulnerabilities at hackmeeting 0x1D , with a presentation titled “ Race condition, bypass e altri divertimenti: una RCE con quello che passa il convento​ 🤓”… Here are the slides from my talk. Giving a talk about this research at hackmeeting 0x1D was genuinely exciting for me. For anyone who has attended one before, hackmeeting is much more than a computer conference: it’s a community-driven event where hacking, technology, philosophy, experimentation, and knowledge sharing come together in a uniquely informal atmosphere. I think presenting an exploit chain that combined a Race Condition , AI-assisted CAPTCHA solving, and ultimately Remote Code Execution felt particularly fitting for an event that has always celebrated curiosity and creative problem-solving. 🗨️ What is Discuz!? For anyone unfamiliar with the Chinese Internet landscape, Discuz! (initially developed by Comsenz Technology — which was acquired by Tencent in August 2010 — and later maintained by open-source communities) is essentially the WordPress or vBulletin of the Chinese web. Originally released in the early 2000s, it became the absolute backbone of online communities, bulletin board systems (BBS), and social networks across Asia. At its peak, around 2010, Discuz! powered approximately 1.4 million active websites (the vast majority in China), handling massive amounts of traffic and user data. Because of this widespread adoption, any security flaw found within the platform historically carried a massive blast radius, often leading to widespread automated exploitation campaigns. • The Evolution: Discuz! X5.0 Over the years, the Discuz! codebase underwent numerous rewrites and refactorings to modernize its architecture, transition to newer PHP versions, and implement stricter security controls, such as token-based CSRF protection, stricter input filtering, and advanced database abstraction layers. Discuz! X5.0, officially released on March 20, 2026 , represents the latest generation of this evolutionary line. Built to handle modern web requirements, it introduces a significantly modernized architecture that requires PHP 8.0+ and MySQL 5.7+ to run. Alongside these architectural improvements, this new version introduces: New template system : a fully mobile-friendly frontend architecture. Native internationalization : streamlined multi-language deployment out of the box. Automated updates : built-in mechanisms to ensure rapid deployment of security patches. Updated security defenses : hardened systems designed specifically to prevent classic automated attacks, such as bot registrations and credential stuffing. Despite these modern security layers, the complexity of managing legacy features while introducing new application logic often creates subtle architectural blind spots. It is precisely within the intersection of these new “systems” — specifically the cross-context reuse of a cryptographic token and the flawed plugin import logic that paves the way for RCE — that our exploit chain takes root. 🔗 Chaining Bugs to get Pre-Auth RCE Finding a single vulnerability that directly leads to Remote Code Execution ( RCE ) is becoming increasi...