Error: Invalid Captcha after Resending an OTP Code

Knowledge Articles
1

Overview

This article explains why users receive the following error after an end-user tries to receive multiple One-Time Password (OTP) codes and whether there is a way to resend the OTP with the same captcha value.

Error: Invalid Captcha

Applies To

  • Custom Login Page
  • Passwordless CAPTCHA Flow
  • One-Time Password (OTP) Multi-Factor Authentication (MFA)

Solution

This behavior is intentional and designed for security purposes.

  • Making the resend OTP code process seamless by not requiring users to solve the Captcha value again will effectively give attackers an unlimited number of code tries.
  • An attacker can solve the Captcha once and try an unlimited number of times to resend and try the code.
1 Like