How a simple login API was returning auth tokens before OTP verification — and how I reported it to CERT-IN.
By Mughunthen — Security Researcher | Neyveli
I am Mughunthen, a security researcher from Neyveli.
While casually testing a local food delivery app — The Kari Kadai — for security vulnerabilities, I stumbled upon a severe flaw in their authentication flow. I never expected a simple login request to leak sensitive session tokens outright.
The Vulnerability
Found by: Mughunthen
Endpoint: POST /user/login
Vulnerable Response
{
"status": "SUCCESS",
"message": "OTP has been sent to your mobile",
"data": {
"id": "[REDACTED]",
"user_type": "USER",
"mobile_number": "[REDACTED]",
"auth_token": "[REDACTED]",
"activation_token": "[REDACTED]"
}
}
The Issue: The server generates and returns the sensitive auth_token immediately in the initial request response — before the user inputs or verifies the OTP. Anyone with a targeted user's mobile number can intercept this response and completely bypass the OTP verification mechanism.
Impact & Mitigation
Impact
Account Takeover (ATO): Attackers can gain full access to any user account just by knowing their phone number.
PII Leakage: Exposed tokens grant access to user profile details, order history, and saved addresses.
Broken Authentication: Invalidates the security purpose of 2FA/OTP.
Recommended Fix
Generate and issue the auth_token only after the user successfully validates the OTP on a separate verification endpoint (/user/verify-otp).
Status: Reported to CERT-In / Pending Fix
About Me
Mughunthen — Bug Bounty Hunter | CERT-IN Reporter
Top comments (0)