Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. (CVE-2024-5563)

This vulnerability arises from an incomplete implementation of reCaptcha in specific authentication flows, which results in the reCaptcha mechanism not being enforced even when enabled. Attackers can exploit this oversight to bypass the intended protection against automated login attempts. The primary risk is that brute force attacks may succeed, potentially granting unauthorized access to user accounts and exposing sensitive data. The CVSS 3.1 vector indicates the attack requires network access, has high attack complexity, no privileges or user interaction needed, and impacts confidentiality and integrity to a limited extent without affecting availability.

Attackers can bypass reCaptcha protections on certain authentication flows, increasing the risk of brute force attacks. If successful, these attacks may lead to unauthorized access to user accounts and exposure of sensitive information. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider additional protective measures for authentication flows, such as monitoring for brute force attempts or implementing alternative rate-limiting controls.