An AI testing agent developed by Reflectiz discovered an authentication bypass vulnerability on a major insurer's production website.
The flaw allowed users to redirect one-time passcodes to arbitrary email addresses by modifying delivery channel parameters in login requests.
How the connection problem worked
During the login, the website sends a confirmation code. The request was contained in two fields specified by the user: the sending channel and the recipient address.
While the code should normally go to the details associated with the account, the system could change the channel to email and indicate a completely different address that the user controlled. The insurance company's system never checked whether this email address actually corresponded to the account holder.
In this way, the artificial intelligence system requested a login code, sent it to an email it controlled, and managed to successfully log in to the account before its protection mechanisms stopped the test.
READ ALSO
New dangerous program for Android phones replaces banking apps
The update and the previous check
Reflectiz notified the insurance company of the finding. The insurance company, for its part, said that its website had been subject to a human security audit about six months prior to this test, without the specific issue being identified at the time.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)