Cloudflare Turnstile stores a token in your browser. I found you can copy it from one browser, paste it into another, and skip the CAPTCHA completely.
I tested it on their own demo site. Worked perfectly.
I reported it. Gave them the code proof. Showed them how to do it.
They said "we see it works." Then they said "out of scope" and locked the report.
They're fixing it now. Using my work. I get nothing.
That's it. That's the story.
How to do it:
Go to demo.turnstile.workers.dev
Solve the CAPTCHA
Open DevTools → Local Storage
Copy _cftscs_0x4AAAAAAADnPIDROrmt1Wwj
Open incognito
Paste it before page loads
Refresh – no CAPTCHA
From their own code:
javascript
localStorage.setItem(_cftscs_${fe}, n.scs);
javascript
ce = localStorage.getItem(scsKey);
// No IP check. No browser check.
No validation. Just works anywhere.
Their excuse:
"Turnstile is out of scope."
The policy says "automated bypasses via script" are excluded.
I said "I did it manually, no script."
They said "we know the wording is vague, we'll fix it." Then locked the report.
They took my research. They're fixing it. I got nothing.
That's how bug bounties work sometimes.
Companies want your work. They just don't want to pay for it.
Top comments (0)