For some site configurations where forms are being cached, ALTCHA validation can potentially be bypassed.
captcha_sid hidden field value when inspected via browserrequired property should manually be removed via the browser inspector) and submit the second formThe second form submit should throw a validation error, but is actually submitted since the captcha_sid was already marked with status 1 in the captcha_sessions table.
Let the CAPTCHA module know the ALTCHA widget is cacheable, since we always use a custom validation callback, and don't store a solution in the captcha_sessions table anyway.
Active
1.0
Code