Tata B2B Platform Flaw Lets Attackers Bypass OTP and Take Over Accounts
Brief
Tata Nexarc has fixed a critical authentication flaw that exposed login one-time passwords (OTPs) in client-visible API responses.
The issue could have allowed an unauthenticated attacker who knows a registered mobile number to obtain the OTP required for passwordless login and seize the account.
Eaton reported the vulnerability to the Indian Computer Emergency Response Team (CERT-In) on July 30; CERT-In confirmed a fix. Public disclosure followed on August 24.
Tata B2B Platform Flaw
Tata Nexarc uses an OTP workflow to authenticate users using an email address or a mobile number. Eaton found that the request initiating this workflow returned a field named otpGeneratedForMobile in the response.
Although the payload was AES-encrypted, the platform’s client-side JavaScript included the logic needed to decrypt and process it.