S-Pankki: Email/OTP verification bypass leads to Pre-Account Takeover.

Handled in https://jira.sok.fi/browse/VOIK-6267...

Input validation

Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account...

CVE-2020-27416

Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account...

CVE-2020-27416

The CVE-2020-27416 entry describes a vulnerability in the Mahavitaran Android application (7.50 and earlier) where improper OTP validation enables account takeover and remote control of a user’s account. The issue is rooted in OTP handling/authentication flaws that allow an attacker to compromise...

CVE-2021-41716

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

CVE-2021-41716

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

Design/Logic Flaw

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

CVE-2021-41716

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function...

CVE-2021-41716

The CVE-2021-41716 entry applies to the Mahavitara Android Application (Maharashtra State Electricity Board) versions 8.20 and earlier. The vulnerability is an OTP fixation flaw in the password reset function that enables remote account takeover. Connected sources corroborate the issue and its im...

FortiAuthenticator - "Mandatory password and OTP" setting not enforcing OTP on unimported remote users

An incorrect implementation of authentication algorithm vulnerability CWE-303 in FortiAuthenticator may allow an user whose LDAP account is unimported to bypass the second factor of authentication via a RADIUS login portal...

Threat Actors Weaponize Telegram Bots for ExtortionThreat Actors Weaponize Telegram Bots to Compromise PayPal Accounts

Cybercriminals are using Telegram bots to steal one-time password tokens OTPs and defraud people through banks and online payment systems, including PayPal, Apple Pay and Google Pay, new research has found. Researchers from Intel 471 discovered the campaign, which has been operational since June,...

The Rise of One-Time Password Interception Bots

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords OTPs that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitor...

UPchieve: Missing Validation in editing "Your Phone Number"

Verification method is missing in changing "Your Phone Number" . There is no OTP or code send to new number for validating. POC video : recording-1632905982558.webm @thug645 Impact Misconfiguration...

Exposure of Sensitive Information in keycloak

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events...

Zomato: Claiming the listing of a non-delivery restaurant through OTP manipulation

Summary: Am able to claim any restaurant which is not claimed before. Description: An endpoint POST /restaurant-onboard-diy/v2/send-auto-claim-otp HTTP/2 sends OTP to the restaurant mobile no. Request Request:1 is - POST /restaurant-onboard-diy/v2/send-auto-claim-otp HTTP/2 Host: www.zomato.com...

UPchieve: OTP reflecting in response sensitive data exposure leads to account take over

Summary: Sensitive data that is otp is reflecting in the response of phone number otp verification in https://app.upchieve.org Steps To Reproduce: 1. Signin with a account 2.After signin it will ask for phone number for otp verification. 3.Capture the request using burpsuite and see the response...

MTN Group: Otp bypass in verifying nin

Summary: while conducting my research in your website I found that while verifying NIN number it send the otp to the enterd mobile number that can be bypassed. Steps To Reproduce: 1 Go to https://nin.mtnonline.com/nin/ 2 click submit nin.Now it will redirect to another page...

org.apereo.cas:cas-server-support-gauth (>=6.2.0 <=6.2.3), org.apereo.cas:cas-server-support-gauth-core (>=6.2.0 <=6.2.3) +9 more potentially affected by CVE-2020-27178 via org.apereo.cas:cas-server-support-otp-mfa-core (>=6.2.0 <=6.2.3)

org.apereo.cas:cas-server-support-otp-mfa-core MAVEN version =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.3 Source cves: CVE-2020-27178 Source advisory: OSV:GHSA-Q39C-5VH5-VW2P...

org.apereo.cas:cas-server-support-gauth (>=6.0.0 <=6.1.7.1), org.apereo.cas:cas-server-support-gauth-core (>=6.0.0 <=6.1.7.1) +8 more potentially affected by CVE-2020-27178 via org.apereo.cas:cas-server-support-otp-mfa-core (>=6.0.0 <=6.1.7.1)

org.apereo.cas:cas-server-support-otp-mfa-core MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.0, =6.0.0, =6.0.0, =6.1.0, =6.1.7.1 Source cves: CVE-2020-27178 Source advisory: OSV:GHSA-Q39C-5VH5-VW2P...

A hacker claims to be selling sensitive data from OTP generating firm

By Habiba Rashid A hacker appears to be selling sensitive data they claim to have stolen from an OTP-generating company. Here's what we know so far! This is a post from HackRead.com Read the original post: A hacker claims to be selling sensitive data from OTP generating firm...