An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
Reflectiz says its AI pentest agent found a critical OTP bypass on a major insurer's website.
In a contributed report, Reflectiz said its AI pentesting agent found a critical one-time-passcode bypass on a major insurer's production website with millions of users. The login request could change the delivery channel and address, and the server sent the code without confirming the address was registered to the account. During an authorized test the agent received a code at an inbox it controlled and logged in before guardrails halted it. Reflectiz reported the issue; the article does not name the insurer, cite a CVE, or say criminals are exploiting it.
- An insurer login let the request choose the OTP channel and destination.
- The server did not check that the address belonged to the account.
- Reflectiz's agent confirmed login, then its guardrails stopped the test.
- The unnamed insurer said it had been pentested about six months earlier.
From the original article
4 min read at thehackernews.com
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.