When “try again later” still tells you the OTP was correct: an account takeover story.
I wrote up an old OLX account takeover bug where the interesting part was not that OTPs existed. It was that the lockout state still leaked whether the submitted OTP was correct. The flow looked blocked from the outside:
📄
This source provides headlines only. Use the button below to read the complete article on the original site.
📰 Read the original article on r/hacking
Originally published by r/hacking. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.