Lack of Resources & Rate Limiting (RL)

Attackers can circumvent captcha protection by removing cookies compromising the system's security.

Attackers can circumvent captcha protection by adding headers like x-forwarded-for, compromising the system's security.

Ignoring CAPTCHA validation without the field present in the backend server can result in severe damage and vulnerabilities.

The server fails to enforce captcha expiration, allowing users to submit multiple requests using the same captcha value without time restrictions.

Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the user.