Captcha bypass at registration

How it was found

Affected URL:

https://demo.weblate.org/accounts/register/

Issue:

The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above URL captcha is simple enough that can be read by any script. An attacker can write a simple script to get value of those captcha ( as simple as document.getElementById("div_id_captcha") in JS ) and solve them.

Solution:

Image captcha should be implemented whose value cannot be read by script. Google captcha can be an effective solution.