Source:
<code>public Response create(@FormParam("username") String username, @FormParam("firstname") String firstName, @FormParam("lastname") String lastName, @FormParam("email") String email, @FormParam("application") List<String> applications, @FormParam("group") List<String> groups, @FormParam("password") String password, @FormParam("reCaptchaResponse") String reCaptchaResponse, @Context HttpServletRequest request) { if(Strings.isNullOrEmpty(email)) throw new BadRequestException("Email cannot be empty"); if(Strings.isNullOrEmpty(username)) throw new BadRequestException("User name cannot be empty"); if(new EmailValidator().isValid(username, null)) throw new BadRequestException("User name cannot be an email address"); <START> if (!Strings.isNullOrEmpty(reCaptchaResponse) && !reCaptchaService.verify(reCaptchaResponse)) throw new BadRequestException("Invalid recaptcha response"); <END> String name = username; if(CURRENT_USER_NAME.equals(name)) throw new BadRequestException("Reserved user name: " + CURRENT_USER_NAME); User user = userService.findUser(name); if(user != null) throw new BadRequestException("User already exists: " + name); user = userService.findUserByEmail(email); if(user != null) throw new BadRequestException("Email already in use: " + user.getEmail()); user = User.newBuilder().name(name).realm(AgateUserRealm.AGATE_REALM).role(Roles.AGATE_USER).pending() .firstName(firstName).lastName(lastName).email(email).build(); user.setGroups(Sets.newHashSet(groups)); user.setApplications(Sets.newHashSet(applications)); user.setAttributes(extractAttributes(request)); if(isRequestedByApplication(request)) { user.setStatus(UserStatus.APPROVED); } userService.createUser(user, password); return Response .created(UriBuilder.fromPath(JerseyConfiguration.WS_ROOT).path(UserResource.class).build(user.getId())).build(); }</code><technical_language>This check means captcha by-passed providing empty captcha response</technical_language>

Target:
public Response create(@FormParam("username") String username, @FormParam("firstname") String firstName, @FormParam("lastname") String lastName, @FormParam("email") String email, @FormParam("application") List<String> applications, @FormParam("group") List<String> groups, @FormParam("password") String password, @FormParam("reCaptchaResponse") String reCaptchaResponse, @Context HttpServletRequest request) { if(Strings.isNullOrEmpty(email)) throw new BadRequestException("Email cannot be empty"); if(Strings.isNullOrEmpty(username)) throw new BadRequestException("User name cannot be empty"); if(new EmailValidator().isValid(username, null)) throw new BadRequestException("User name cannot be an email address"); if (!reCaptchaService.verify(reCaptchaResponse)) throw new BadRequestException("Invalid reCaptcha response"); String name = username; if(CURRENT_USER_NAME.equals(name)) throw new BadRequestException("Reserved user name: " + CURRENT_USER_NAME); User user = userService.findUser(name); if(user != null) throw new BadRequestException("User already exists: " + name); user = userService.findUserByEmail(email); if(user != null) throw new BadRequestException("Email already in use: " + user.getEmail()); user = User.newBuilder().name(name).realm(AgateUserRealm.AGATE_REALM).role(Roles.AGATE_USER).pending() .firstName(firstName).lastName(lastName).email(email).build(); user.setGroups(Sets.newHashSet(groups)); user.setApplications(Sets.newHashSet(applications)); user.setAttributes(extractAttributes(request)); if(isRequestedByApplication(request)) { user.setStatus(UserStatus.APPROVED); } userService.createUser(user, password); return Response .created(UriBuilder.fromPath(JerseyConfiguration.WS_ROOT).path(UserResource.class).build(user.getId())).build(); }