mirror of
https://github.com/mCaptcha/mCaptcha.git
synced 2025-11-23 22:15:46 +00:00
SUMMARY
At present, sitekey can be abused by installing it on a third-party
site as verifying the access token returned from CAPTCHA validation
doesn't require any authentication.
This fix uses account secret authentication to verify access tokens
credits: by @gusted