{"id":"CVE-2024-5563","kind":"vulnerability","aliases":["CVE-2024-5563"],"related":[],"title":"Authentication flows skip reCaptcha even when the option is enabled","description":"Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.\n\nBrute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.","summary":"Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. An attacker can bypass the protection and run brute force attacks that may lead to unauthorized access to user accounts and sensitive information.","severity":"medium","cvss":4.8,"epss":0.00192,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-21T14:17:05+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:33:08+00:00","updated_at":"2026-10-25T04:33:08+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T04:33:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Authentication flows skip reCaptcha even when the option is enabled","impact":"medium","summary":"Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. An attacker can bypass the protection and run brute force attacks that may lead to unauthorized access to user accounts and sensitive information.","category":"other","nicknames":[],"who_cares":[],"confidence":0.4,"needs_auth":"no","worst_case":"Attacker brute-forces logins and reaches user accounts and sensitive data.","analyst_note":"Sources do not name the product or affected versions; find the vendor advisory on the NVD page to identify the affected software and fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000508,"input_tokens":3370,"output_tokens":342,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':12A,15A '-5563':13A,16A 'access':53B,99C 'account':56B,102C 'appli':25B,68C 'attack':38B,47B,83C,92C 'attempt':108C 'authent':1A,28B,71C 'brute':45B,90C 'bypass':40B,85C 'certain':27B,70C 'combin':111C 'credenti':110C 'cve':11A,14A 'due':17B,60C 'enabl':10A,36B,79C 'even':5A,30B,73C 'flow':2A,29B,72C 'forc':46B,91C 'implement':21B,64C 'incomplet':20B,63C 'inform':59B,105C 'intend':87C 'lead':50B,96C 'may':49B 'mechan':89C 'option':8A,34B,77C 'oversight':81C 'permit':82C 'protect':42B,88C 'recaptcha':4A,22B,33B,65C,76C 'run':44B 'sensit':58B,104C 'skip':3A 'success':94C 'systemat':107C 'unauthor':52B,98C 'user':55B,101C 'various':109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-5563","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5563","severity":null,"published_at":"2026-10-21T14:17:05+00:00","modified_at":"2026-10-21T14:17:05+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2024-5563","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5563","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}