Bypassing OTP Verification by Modifying the Server Response

While testing an authentication flow, I discovered an OTP verification bypass that allowed the login process to continue without entering the correct code.

The issue occurred when I intercepted the OTP verification response and changed the result from "Failed" to "OK".

How It Worked During testing I followed these steps:

1. Created an account and logged out.
2. Started the login process and entered an invalid OTP.
3. Intercepted the verification traffic using Burp Suite.
4. Changed the verification response from "Failed" to "OK".

5. Forwarded the modified response

The application accepted the verification result and redirected me to the account.

If the server does not independently enforce OTP verification an attacker may bypass this authentication step and gain access to an account without knowing the valid OTP.

The demonstrated impact depends on whether the server actually grants authenticated access based on the modified response or whether the result is only a client-side UI change.

Conclusion Authentication decisions must be enforced on the server side. A client must never be trusted to determine whether an OTP is valid. The affected service's identity has been omitted for responsible disclosure.