A significant security vulnerability in Tata Nexarc, a B2B procurement platform designed for small and medium enterprises in India, was found to permit account takeovers using merely a registered phone number.
The flaw involved an exposed one-time password (OTP) in a decryptable API response, negating the need for SMS interception or phishing. Tata Nexarc facilitates business transactions with steel and building material suppliers.
Tata Nexarc’s OTP Vulnerability Exposed
A security expert revealed that the platform’s OTP login mechanism used an endpoint, CheckForUsersRegisteredWithEmailOrMobileNoAndSendOTP.do, which dispatched an OTP to the mobile number provided. Crucially, this same process also returned the OTP within the API response, accessible to the client.
Despite the encryption of API traffic, the encryption and decryption logic operated in client-side JavaScript through AES. This setup allowed the researcher to insert a breakpoint in the JavaScript, revealing the plaintext OTP.
Implications of the Security Breach
The decrypted API response included the otpGeneratedForMobile field, presenting the exact OTP that was sent to the account holder via SMS. Consequently, an attacker could input a victim’s mobile number, obtain the OTP from the API response, and complete the login as that user. This flaw turned the OTP system into a vulnerability for client-side secret disclosure.
OTPs are supposed to verify control over a phone number or email account. However, returning the OTP in a browser-accessible manner nullifies this protection. The expert noted that the visible login functionality did not require the exposed OTP field, rendering its presence an unnecessary risk.
Response and Resolution
According to Eaton-Works, the potential damage hinges on the affected account’s privileges. Tests showed that a guessed mobile number linked to Tata Business Hub’s main account granted administrator access, enabling comprehensive control over corporate pages, employee management, and more.
Reportedly, the researcher also managed to access an administrative account connected to Tata Steel using the organization’s associated mobile number. Although the disclosure mentioned no method for mass phone number extraction, attackers could target individuals through public information or compromised accounts.
The vulnerability was reported to India’s Computer Emergency Response Team (CERT-In) on July 30, 2026, and was confirmed fixed by July 31, 2026. The researcher disclosed on August 24 that the vulnerable otpGeneratedForMobile field had been removed from the API response.
This incident underscores a crucial rule in OTP implementation: authentication codes must never be visible to clients, stored in plaintext, or exposed via browser-accessible APIs. Instead, servers should internally validate OTPs, limit data in responses, enforce expiration, and monitor authentication attempts to prevent account takeovers.
