The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.

Reflectiz's AI pentesting agent was mapping the login flow of a major insurer's production website, which has millions of users.

The agent requested a login code and directed it to an email inbox it controlled. The code arrived. The login went through. Its guardrails halted the test after the login succeeded.

The agent had discovered a critical-severity authentication bypass on its own. Reflectiz reported it to the insurer.

A one-time passcode (OTP) only proves who you are if it goes somewhere already linked to the account. Here, that link was broken.

The login request carried two fields that decided delivery: the channel and the address. Normally, the code went by text to the phone number on the account. But the request could change the channel. Switch it to email, and the server sent the code to whatever address the request named, not the address registered to the account.

Binding a code to its account is one of the most basic checks in authentication. OWASP's testing guide asks this in plain words: "Are the OTPs tied to the correct user account...?"

An attacker with the required customer identifiers could potentially use the flaw to access that customer's account.

The agent began with reconnaissance, looking at the site's JavaScript and the API calls behind its pages. That analysis surfaced the OTP request and two values that appeared to control how and where the code was sent.

Source link