An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
AI-summarised brief · reviewed before publication
Reflectiz’s AI pentesting agent discovered a critical OTP bypass on a major insurer’s production website. By manipulating the login request’s channel and address fields, the agent redirected the one‑time passcode to an email inbox it controlled, allowing successful authentication without the registered phone number. The flaw, uncovered during live testing, exposed a basic authentication oversight that could let attackers access customer accounts. The insurer was notified, and the incident underscores the limitations of traditional point‑in‑time testing.
💡 Why It Matters
- · The breach shows how automated, continuous testing can expose vulnerabilities that static scans miss, forcing insurers to rethink security protocols.