Threat reportVulnerabilityTL-2026-3502
Critical OTP Authentication Bypass in Insurer Login Found by AI Pentesting Agent (OTP Delivery Redirection)
Critical OTP Authentication Bypass in Insurer Login Found by (TL-2026-3502), also tracked as OTP delivery redirection, is a critical-severity software vulnerability, first published 2026-10-14. It has no confirmed attribution, affects Undisclosed major international insurance company Customer-facing, maps to 5 MITRE ATT&CK techniques (T1078, T1111, T1190), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3502
- Threat ID
- TL-2026-3502
- Also known as
- OTP delivery redirection, OTP recipient parameter tampering
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- insurance, finance, web-applications
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Critical OTP Authentication Bypass in Insurer Login Found by
Malware and tooling: Reflectiz agentic pentesting (Offensive Hub)
How Critical OTP Authentication Bypass in Insurer Login Found by works
Reflectiz's agentic AI pentesting platform autonomously found a critical one-time passcode (OTP) bypass on a major international insurer's production website login. The login request exposed two client-controlled fields (delivery channel and delivery address) and the server did not verify that the address belonged to the account, so OTPs could be redirected to an attacker-controlled inbox.
Reflectiz, a web-security vendor, launched an agentic pentesting product (Offensive Hub) on 2026-09-08 consisting of multiple cooperating AI agents: a user-flow crawler that maps sites through logins, OTPs and 2FA; a stack fingerprinter that selects applicable attacks; an attack executor that runs and chains attacks; and an independent validator that reproduces findings to remove false positives. During an authorized assessment of a major international insurance company's production website (millions of users), the agent mapped the site's JavaScript and API calls, identified two suspicious fields in the login request that controlled how and where the one-time passcode was delivered, built targeted tests around both parameters, and executed them through the live login flow.
The flaw is a server-side authorization/logic weakness in OTP issuance: the login request carried a channel field (delivery method) and an address field (recipient), and the server delivered the code to whatever address the client supplied instead of the contact registered for the account. The agent directed a code to an inbox it controlled, the code was delivered, and the login flow proceeded without any validation that the recipient address was owned by or registered to the account. This violates the OWASP Web Security Testing Guide authentication question of whether OTPs are tied to the correct user account. The agent confirmed the bypass and then stopped at the authentication guardrails rather than completing a login.
Impact: an attacker who knows or can obtain the customer identifiers needed to start a login (the source states account takeover is potential given sufficient customer identifiers) could receive the second factor themselves, defeating OTP as a possession factor and enabling account takeover of insurance customer accounts holding personal and policy data. The source states the site had been pentested roughly six months earlier without this flaw being detected. Reflectiz reported the finding to the insurer. The insurer is anonymized in the source; no CVE, CVSS score, affected versions, patch status, attribution or network IOCs are published, and no in-the-wild exploitation is reported. Remediation is server-side: derive the OTP destination only from the account's stored, verified contact data, ignore or reject client-supplied channel/address values, and verify ownership before any change of delivery destination.
MITRE ATT&CK techniques used in TL-2026-3502
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1111 Multi-Factor Authentication Interception
defense-impairment
T1556 Modify Authentication Process
Reconnaissance
Affected products and versions in Critical OTP Authentication Bypass in Insurer Login Found by
- Undisclosed major international insurance company — Customer-facing production website login (OTP/2FA flow)
Vulnerable versions: Production site at time of Reflectiz assessment (not versioned)
Remediation for Critical OTP Authentication Bypass in Insurer Login Found by
Patches
- No CVE or vendor patch published; insurer was notified by Reflectiz and fix status is not stated in the source
Immediate actions
- Stop accepting client-supplied OTP delivery channel and recipient address parameters on login and OTP-issuance endpoints
- Send OTPs only to contact details already stored and verified on the account
- Review authentication logs for OTP issuance where the delivery address differs from the registered contact
Workarounds
- Strip or ignore channel and address fields at a WAF or API gateway on OTP-issuance endpoints
- Temporarily mask or limit account identifiers that can start an OTP login flow
Longer-term hardening
- Bind every OTP server-side to the account, session and delivery destination it was issued for
- Require step-up verification (existing verified factor) before any change to OTP delivery contact
- Add business-logic authentication tests (OWASP WSTG authentication cases) to CI and continuous pentesting rather than point-in-time tests
- Rate-limit and alert on OTP requests per account and per destination address
Weaknesses (CWE) in Critical OTP Authentication Bypass in Insurer Login Found by
Timeline of Critical OTP Authentication Bypass in Insurer Login Found by
- Approximate date (source says roughly six months before the finding): the insurer's site was last conventionally pentested without this OTP flaw being detected
- Security Boulevard publishes general research on OTP bypass methods and hardening, the class of weakness (client-influenced OTP delivery) this finding belongs to
- Reflectiz launches its agentic pentesting platform (Offensive Hub) with crawler, fingerprinter, attack-executor and validator agents, citing a critical OTP finding at a major insurer
- By the launch date the Reflectiz agent had mapped the insurer's JavaScript and API calls, identified the two OTP delivery fields, confirmed the bypass via the live login flow, stopped at authentication guardrails, and the finding was reported to the insurer (exact discovery and report dates not published)
- Reflectiz founders Idan Cohen and Ysrael Gurt present the OTP finding in a live webinar
- Threadlinqs opens tracking for the OTP delivery-redirection weakness pattern for detection and hunting coverage
- Source reports the flaw confirmed exploitable in production by the pentest agent only; no in-the-wild exploitation, CVE, CVSS or patch status published
- The Hacker News publishes the technical write-up describing the channel/address OTP delivery bypass
Sources cited for Critical OTP Authentication Bypass in Insurer Login Found by
- An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
- Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests (HackRead)
- Reflectiz Launches Agentic Pentesting for Websites (CSO Online)
- Reflectiz Launches Agentic Pentesting for Websites (CPO Magazine)
- Reflectiz Launches Agentic Pentesting for Websites (GBHackers press release)
- Reflectiz Founders Case Study Webinar - live reveal of the OTP finding
- OWASP Web Security Testing Guide - Authentication Testing
- Defeating OTP Safeguards: Unveiling Bypass Methods and Fortification Strategies (Security Boulevard)
Detection coverage for TL-2026-3502
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3502 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.