July 26, 2026

OTP Authentication Bypass in the Mor Bijli App

During security testing of the Mor Bijli mobile application, developed by CSPDCL, I identified an OTP authentication bypass.

By Rishabh kumar

Using Burp Suite, I entered an invalid OTP, intercepted the verification request, and dropped it. Despite receiving no successful response from the server, the application still navigated to the consumer dashboard.

Attack flow:

Invalid OTP → verification request dropped → dashboard access granted

The issue indicated that authentication state was being controlled by client-side logic instead of being strictly tied to successful server-side OTP verification.

Security Impact

The vulnerability could potentially allow unauthorized access to consumer account information and application features, depending on the authorization controls implemented on the backend APIs.

  • Enforce OTP verification on the server.
  • Grant access only after a successful authentication response.
  • Issue and validate a secure session token.
  • Protect every sensitive API with authorization checks.
  • Implement OTP expiry, attempt limits, and rate limiting.

I responsibly reported the vulnerability to CERT-In and received an acknowledgement for the finding. :)