@faizedzahar but the issue is not the length of the password or the Captcha. But why they accept passwords as a correct when wrong characters are added at the end, either they are decrypting passwords every time they check, or maybe even storing in plaintext.
A QA engineer walks into a bar. Orders a beer. Orders 0 beers. Orders 99999999999 beers. Orders a lizard. Orders -1 beers. Orders a ueicbksjdhd.
First real customer walks in and asks where the bathroom is. The bar bursts into flames, killing everyone.