Affected Systems
Major insurance company's production website with millions of users. Specific vendor and product not disclosed. Authentication flow allows attacker-controlled OTP delivery address, bypassing account ownership validation.
Exploitation Status
Vulnerability discovered during authorized assessment by Reflectiz AI pentesting agent. No evidence of prior exploitation in the wild. Attack is straightforward once vulnerability is identified—attacker needs customer identifiers and can manipulate OTP delivery channel and address in login request.
Business Impact
Critical authentication bypass allows unauthorized account access if attacker possesses customer identifiers (e.g., username, account number). Server fails to validate that OTP delivery address belongs to the account owner—a fundamental OWASP authentication control failure. Insurer reportedly pentested the site six months prior without detecting this flaw. Impact limited to the specific insurer's site; no CVE assigned, suggesting vendor-specific implementation error rather than widespread product vulnerability.
Urgency
🟠 Within 24 hours
Recommended Actions
- Review all OTP and 2FA implementations to ensure delivery addresses (email, SMS) are validated against registered account data before code generation
- Implement server-side binding checks that verify OTP delivery destinations match account-registered contact methods, per OWASP Authentication Testing Guide
- Audit API endpoints handling authentication flows for user-controllable parameters that influence security-critical decisions (channel, destination, method)
- Increase frequency of authentication flow testing in production or staging environments, especially after releases that modify login, password reset, or account recovery workflows
- Log and monitor for anomalous OTP requests where delivery channel or address differs from account defaults