OTP Authentication Weakness - Backend vs WAF Gap Identified a flaw in an OTP verification flow where…
Imrane T. — Offensive Security | Attack Chains & Business Logic
OTP Authentication Weakness - Backend vs WAF Gap
Identified a flaw in an OTP verification flow where security controls were not enforced at the application layer.
Key observations:
- No backend rate limiting on /auth/.../otp/verify
- No account/session lockout after repeated failures
- No OTP expiration enforcement server-side
- Consistent HTTP 400 responses across invalid attempts (no adaptive behavior)
Protection relied solely on WAF (Cloudflare):
- ~40–50 attempts per IP before HTTP 429
- Blocking occurs at edge level only
- No backend awareness of attack patterns
Result:
Brute-force becomes feasible via distributed requests (multi-IP / proxy rotation).
Exploitability:
- ~100–300 attempts/min per IP before block
- OTP space (e.g. 4–6 digits) becomes realistically enumerable
- No session invalidation -> continuous attack window
Impact:
- Account Takeover (ATO)
- Unauthorized access to user data
- Scalable attack surface due to lack of backend controls
Takeaway:
If your authentication flow depends on WAF rate limiting without backend enforcement, it is inherently bypassable.
4 reactions · 0 comments