An AI-driven penetration testing tool has revealed a significant security flaw in the login process of a major insurer’s website. The vulnerability, which involves the misuse of a one-time passcode (OTP), highlights critical authentication weaknesses in the system.
The Discovery of the OTP Vulnerability
During a sanctioned security evaluation, an AI agent from Reflectiz identified a severe authentication bypass on a leading insurer’s live website. The agent manipulated the login request to redirect the OTP to a controlled email address, allowing unauthorized access. Despite the ease of executing the attack, demonstrating it on a live system required extensive web interaction knowledge.
Reflectiz’s AI agent successfully mapped the login sequence of the insurer’s website, which is accessed by millions of users. By requesting the login code to be sent to its own email, the agent confirmed the bypass and immediately reported the issue to the insurer.
Understanding the Authentication Flaw
The flaw was rooted in the login request format, where two fields determined the OTP delivery method and destination. Typically, the OTP is sent to a registered phone number, but the request allowed changes to both the channel and address without verification. This oversight enabled the code to be sent to any email, breaking the account link and making it susceptible to unauthorized access.
The failure to bind the OTP to its respective account contradicts basic security practices outlined in OWASP’s guidelines, which emphasize binding OTPs to correct user accounts. With the necessary customer identifiers, attackers could exploit this vulnerability to gain unauthorized account access.
Implications and Future Outlook
Reflectiz’s AI agent used extensive web context built over years to identify the issue. This approach contrasts with traditional methods that often stop at login gates, missing deeper workflow vulnerabilities. Reflectiz’s decade-long experience scanning live websites provided the foundation for the agent’s success.
The discovery underscores the limitations of point-in-time security testing. While the insurer had conducted a pentest six months earlier, the flaw went undetected, highlighting the need for continuous testing. Reflectiz’s agent-driven approach allows for repeated, focused testing to keep up with site changes and evolving threats.
Reflectiz offers a demonstration of their agentic pentesting capabilities, inviting businesses to bring challenging workflows for assessment. The demo showcases how the agent navigates complex workflows, validates findings, and documents scope and coverage.
Interested parties are encouraged to book a demo to explore how Reflectiz can enhance their security posture through advanced AI-driven testing.
