🔴 Critical: An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
-
During an authorized assessment, an AI pentesting agent independently identified a critical authentication bypass on a major insurer's production website. The flaw itself was straightforward: a single login request allowed the user to choose where the one-time passcode was delivered, effectively undermining the OTP verification step. Interestingly, the technical exploitation was the easy part — the real challenge lay in proving the issue on a live production system.
- The vulnerability was discovered autonomously by an AI agent during an authorized engagement.
- The login flow trusted user-supplied input for OTP delivery destination.
- Validation and proof on the live site proved harder than the attack itself.
If your organization relies on OTP-based authentication, it is worth reviewing how delivery destinations are selected and whether user input can influence that choice. Have you audited your login flows for similar trust issues?
Source: The Hacker News
Does your organization's authentication flow allow users to control where OTPs are sent?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login