I was testing rate limit on the login page of a site. It was captcha protected. I could not even intercept the POST request on burp, so from Google Chrome I looked at the logs and in its POST request, it was passing this captcha parameter and also other recaptcha requests.
So then I ran Firefox again which is connected with burp. This time I used private tab and tested the same login page. To my surprise there were no recaptcha requests, also no captcha parameter or value in login POST request. It allowed me to test unlimited payloads and still giving right response for password.
Can anyone explain to me what is happening here? Why running browser on private allowed me to bypass recaptcha? I know this is a vulnerability but how and what is causing it?