Loading story…
A critical authentication flaw in Tata Nexarc, Tata’s B2B procurement platform for small and medium businesses in India, exposed one-time passwords in a browser-accessible API response and allowed account takeover with only a victim’s registered mobile number. The vulnerable OTP login flow returned the generated code in a decryptable response field, enabling an attacker to retrieve the OTP client-side and authenticate without intercepting SMS messages or brute-forcing the code.
The researcher said the issue could expose high-privilege accounts, including administrator access associated with Tata Business Hub and an account linked to Tata Steel. The flaw was reported to CERT-In, acknowledged the same day, and remediated by removing the otpGeneratedForMobile field from the API response; public discussion later highlighted the case as a reminder that OTP values must never be returned to clients or exposed through browser-accessible APIs.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The researcher published a disclosure describing how Tata Nexarc's OTP login flow exposed one-time passwords in API responses, enabling account takeover with only a victim's phone number. The disclosure also described impact to high-privilege accounts, including administrator access tied to Tata Business Hub and an account linked to Tata Steel.
CERT-In confirmed the flaw was fixed by removing the otpGeneratedForMobile field from the API response. This remediation stopped the application from returning the SMS OTP to the client.
CERT-In acknowledged receipt of the Tata Nexarc vulnerability report on the same day it was submitted. This established official awareness of the account-takeover issue.
A researcher reported a critical authentication flaw in Tata Nexarc to CERT-In. The issue allowed account takeover because the platform returned the generated OTP in a decryptable API response.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical vulnerabilities in VE Commercial Vehicles' **My Eicher** fleet management platform exposed undocumented, unauthenticated internal and administrative APIs that allowed attackers to enumerate customers, users, vehicles, historical OTPs, and sensitive uploaded documents. Reporting on the disclosure said the exposure affected roughly **748,000 customers** and **676,000 vehicles** tied to the Volvo Group and Eicher Motors joint venture in India, with accessible data including mobile numbers, encrypted passwords, identity documents, and vehicle geolocation. The researcher said the flaws enabled **account takeover** by retrieving a victim's OTP or abusing password-reset functions without apparent user notification, which could have granted full access to fleet tracking and management features for arbitrary customer accounts. The issues were reported to VECV in November 2025, the main vulnerable API access was removed on November 20, 2025, and additional weaknesses were remediated on July 28, 2026; the public disclosure described the platform as secured with no current threat to customers or vehicles.
Aug 2, 2026
Group-IB reported that a large-scale phishing operation dubbed **0ktapus** targeted organizations using Okta by sending employees SMS messages that linked to fake Okta sign-in pages. The campaign harvested usernames, passwords, and one-time **2FA** codes, allowing attackers to use stolen credentials almost immediately before the codes expired. Researchers said the operation relied on relatively simple infrastructure, including **169 phishing domains**, a **Nuxt.js** frontend, a **Django** backend, and **Telegram** bots and channels used to collect stolen data in near real time. The activity was linked to compromises across multiple sectors, including IT, cloud services, finance, telecommunications, and cryptocurrency, with victims concentrated in the United States and Canada. Group-IB said the campaign was active by at least March 2022 and expanded into supply-chain intrusions affecting **Twilio**, **Mailchimp**, and **Klaviyo**, with downstream impact on customers of **Signal** and **DigitalOcean**. The firm said the attackers likely sought access to private data, internal documents, financial assets, and user accounts, and it urged organizations to adopt phishing-resistant MFA such as **FIDO2 security keys**, verify login URLs carefully, and reset credentials and revoke sessions immediately after suspected compromise.
Sep 3, 2026
A critical authentication bypass vulnerability, tracked as **CVE-2026-15014**, affects the **SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery** WordPress plugin in versions through `3.9.7`. The flaw stems from the plugin trusting a session-level `$_SESSION['sa_mobile_verified']` flag that is not bound to the specific phone number that completed OTP verification. An unauthenticated attacker can verify a phone number they control, then resubmit registration data with a victim’s `billing_phone` value and trigger `wp_set_auth_cookie()` for the victim account. The bug carries a **CVSS 9.8** severity rating and can allow takeover of any existing WordPress user whose registered phone number is known or guessable, including administrators, potentially leading to full site compromise. Reports say public proof-of-concept details are available and exploitation attempts have already been observed. The issue is fixed in version `3.9.8`, and defenders are being urged to update immediately or temporarily disable the plugin while ensuring OTP verification is tied to the verified phone number.
Jul 28, 2026