HexBrain

Veris · Report #124173

Captcha Bypass enable login bruteforce

Validstatus
5upvotes
13 May 2016disclosed

How it was found

HI

There is captcha bypass, which can lead to login credentials bruteforce attack.

Just remove &g-recaptcha-response from request, and the server accepts your request.

Please check the screenshots...

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original