# Critical OTP Authentication Bypass in Insurer Login Found by AI Pentesting Agent (OTP Delivery Redirection)

> Reflectiz's agentic AI pentesting platform autonomously found a critical one-time passcode (OTP) bypass on a major international insurer's production website login. The login request exposed two client-controlled fields (delivery channel and delivery address) and the server did not verify that the address belonged to the account, so OTPs could be redirected to an attacker-controlled inbox.

- **Published:** 2026-10-14T12:17:07Z
- **Last reviewed:** 2026-10-14T12:17:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3502
- **ID:** TL-2026-3502
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Reflectiz, a web-security vendor, launched an agentic pentesting product (Offensive Hub) on 2026-09-08 consisting of multiple cooperating AI agents: a user-flow crawler that maps sites through logins, OTPs and 2FA; a stack fingerprinter that selects applicable attacks; an attack executor that runs and chains attacks; and an independent validator that reproduces findings to remove false positives. During an authorized assessment of a major international insurance company's production website (millions of users), the agent mapped the site's JavaScript and API calls, identified two suspicious fields in the login request that controlled how and where the one-time passcode was delivered, built targeted tests around both parameters, and executed them through the live login flow.

The flaw is a server-side authorization/logic weakness in OTP issuance: the login request carried a channel field (delivery method) and an address field (recipient), and the server delivered the code to whatever address the client supplied instead of the contact registered for the account. The agent directed a code to an inbox it controlled, the code was delivered, and the login flow proceeded without any validation that the recipient address was owned by or registered to the account. This violates the OWASP Web Security Testing Guide authentication question of whether OTPs are tied to the correct user account. The agent confirmed the bypass and then stopped at the authentication guardrails rather than completing a login.

Impact: an attacker who knows or can obtain the customer identifiers needed to start a login (the source states account takeover is potential given sufficient customer identifiers) could receive the second factor themselves, defeating OTP as a possession factor and enabling account takeover of insurance customer accounts holding personal and policy data. The source states the site had been pentested roughly six months earlier without this flaw being detected. Reflectiz reported the finding to the insurer. The insurer is anonymized in the source; no CVE, CVSS score, affected versions, patch status, attribution or network IOCs are published, and no in-the-wild exploitation is reported. Remediation is server-side: derive the OTP destination only from the account's stored, verified contact data, ignore or reject client-supplied channel/address values, and verify ownership before any change of delivery destination.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1111 Multi-Factor Authentication Interception
- T1556 Modify Authentication Process
- T1078 Valid Accounts
- T1589 Gather Victim Identity Information

## Sources

- [An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.](https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html)
- [Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests (HackRead)](https://hackread.com/reflectiz-launches-agentic-pentesting-for-websites-up-to-10x-coverage-vs-conventional-pentests/)
- [Reflectiz Launches Agentic Pentesting for Websites (CSO Online)](https://www.csoonline.com/article/4219697/reflectiz-launches-agentic-pentesting-for-websites-up-to-10x-coverage-vs-conventional-pentests.html)
- [Reflectiz Launches Agentic Pentesting for Websites (CPO Magazine)](https://www.cpomagazine.com/?p=42227)
- [Reflectiz Launches Agentic Pentesting for Websites (GBHackers press release)](https://gbhackers.com/reflectiz-launches-agentic-pentesting-for-websites-up-to-10x-coverage-vs-conventional-pentests/amp/)
- [Reflectiz Founders Case Study Webinar - live reveal of the OTP finding](https://www.reflectiz.com/lp/founders-case-study-webinar/)
- [OWASP Web Security Testing Guide - Authentication Testing](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/README)
- [Defeating OTP Safeguards: Unveiling Bypass Methods and Fortification Strategies (Security Boulevard)](https://securityboulevard.com/2025/08/defeating-otp-safeguards-unveiling-bypass-methods-and-fortification-strategies/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3502