AI Pentesting Agent Finds OTP Authentication Bypass on Insurer’s Production Website
Summary
Reflectiz says its AI pentesting agent found an OTP bypass on an insurer’s production site by changing the login request’s delivery channel and email address. The company reported the flaw to the insurer.
Key points
- The login flow allowed a request to change the OTP delivery channel and specify an email address not tied to the account.
- Reflectiz says its agent confirmed the bypass through the live login flow, then stopped testing after successful login under its guardrails.
- An attacker with the required customer identifiers could potentially use the flaw to access an account.
- Reflectiz says it reported the vulnerability to the insurer; the article does not state whether it has been fixed.
- The article describes the discovery as an example of AI-assisted testing of multi-step web workflows, alongside a promotion for Reflectiz’s pentesting service.
Article Details
- Event Type
- Production website authentication bypass discovered and reported
- Impact
- A critical-severity OTP flaw allowed the login request to redirect a verification code to an attacker-controlled email address instead of the address registered to the account. An attacker with the required customer identifiers could potentially access the customer's account. The affected insurer was not named.