After a user registers successfully (after validating captcha), the captcha challenge is not shown on the registration page again.

To further explain the problem, if right after submitting the registration form, one goes back to the user registration page, the captcha challenge does not show.

This vulnerability can be exploited by bots, after a successful human registration from the same machine.

Comments

robloach’s picture

Version: 5.x-1.1 » 5.x-3.x-dev
Status: Active » Fixed

Just tested in 3.x and it works.

Anonymous’s picture

Status: Fixed » Closed (fixed)