Captcha bypass at registration
Low
Vulnerability Details
### Affected URL:
https://demo.weblate.org/accounts/register/
### Issue:
The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above URL captcha is simple enough that can be read by any script.
An attacker can write a simple script to get value of those captcha ( as simple as `document.getElementById("div_id_captcha")` in JS ) and solve them.
### Solution:
Image captcha should be implemented whose value cannot be read by script.
Google captcha can be an effective solution.
Actions
View on HackerOneReport Stats
- Report ID: 229584
- State: Closed
- Substate: informative
- Upvotes: 2