Tata’s B2B Platform Flaw Enables Account Takeover Just by Knowing Victim’s Phone Number
Brief
A critical authentication flaw in Tata Nexarc, a B2B procurement platform for small and medium businesses in India, allowed attackers to take over accounts by knowing only a registered mobile number.
The platform reportedly exposed the one-time password used for login within a decryptable API response, removing the need to intercept SMS messages, phish users, or brute-force OTPs . Tata Nexarc connects businesses with sellers of steel and building materials.
A security researcher disclosed that its OTP-based login flow called an endpoint named CheckForUsersRegisteredWithEmailOrMobileNoAndSendOTP. do, which initiated OTP delivery to the supplied mobile number. However, the same process also returned the generated OTP to the client.
Although the relevant API traffic was encrypted, the encryption and decryption logic reportedly ran in client-side JavaScript using AES.