I Found an OTP Bypass in The Kari Kadai App That Leaks User Tokens

How a simple login API was returning auth tokens before OTP verification — and how I reported it to CERT-IN. By Mughunthen — Security Researcher | Neyveli I am Mughunthen, a security researcher from Neyveli. While casually testing a local food delivery app — The Kari Kadai — for security vulnerabilities, I stumbled upon a severe flaw in their... Weiterlesen