CWE-804 describes a CAPTCHA challenge that a non-human actor can guess or recognize automatically. The product asks the question, but a bot can answer it. Any web form that leans on a CAPTCHA to keep automation out is exposed: sign-up pages, login forms, password resets, comment boxes, booking flows.
The danger is quiet. The CAPTCHA is present, so the team assumes the control works. Nobody checks whether it actually stops a script.
How it happens
MITRE lists several causes, and they are worth knowing by heart because each one is a design choice someone made.
- An image or audio clip that is not distorted enough, so recognition software reads it as easily as a person does.
- A question in a machine-readable format, such as a simple math problem.
- A question with a small answer space, such as birth years or favorite sports teams. A bot can just try them all.
- A trivia question whose answer sits in a database, such as country capitals or popular entertainers.
- Hints leaking from other data tied to the challenge, such as an image whose filename contains the word being tested.
MITRE also records a real chain: in CVE-2022-4036, an appointment booking app used a weak hash to generate its CAPTCHA, which made the challenge guessable.
What an attacker gains
When a CAPTCHA is the thing standing between a bot and some functionality, defeating it is a protection mechanism bypass. The attacker can perform actions at a higher frequency than any human could, and MITRE names spam as the typical example. Think automated account creation, bulk form submission, or repeated attempts against a login.
How to find it
Test the CAPTCHA as an attacker would. Collect a few hundred challenges and look for patterns: repeated answers, a tiny answer set, predictable formats, filenames or hidden fields that echo the answer. If you can write a twenty line script that passes more often than chance, so can everyone else.
Also review how the challenge value is generated. If it comes from a weak or predictable source, the answer may be derivable without looking at the image at all.
How to fix it
MITRE's record does not list formal mitigations for this entry, so these steps come from the causes above.
- Generate challenge values from a cryptographically strong random source, not a weak hash or a counter.
- Do not use questions with small or lookup friendly answer sets.
- Keep metadata, filenames and hidden fields free of the answer.
- Prefer a maintained CAPTCHA service over a home grown one, and keep its client library updated.
- Do not rely on a CAPTCHA alone. Add rate limits, account lockout rules and anomaly checks so one bypassed control is not the whole defense.
Quick check
Is a math question a good CAPTCHA?
No. MITRE lists math questions as a format that can be recognized automatically. A script can read the question and compute the answer.
If the CAPTCHA is strong, can I drop rate limiting?
No. A CAPTCHA is one control. Keep rate limits and abuse detection so a single bypass does not open the whole function.
