Although no remediation may be required based on this finding alone,
manual testing should ensure that:

1. The server keeps track of CAPTCHA tokens in use and has the token
terminated after its first use or after a period of time. Therefore
preventing replay attacks.

2. The CAPTCHA answer is not hidden in plain text within the response
that is sent to the client.

3. The CAPTCHA image should not be weak and easily solved.
