OTP Authentication Bypass leads to Account Takeover on Mobile App
Hi folks! Recently while testing a mobile application, I found an interesting OTP Authentication Bypass vulnerability that could lead to account takeover. It was super simple and required just a small parameter modification in the API request. The authentication flow starts with a phone number input page: After entering the phone number, you get redirected to the OTP verification page: I started testing the authentication flow and intercepted the traffic using Burp Suite: ...