AI Testing Agent Finds Critical Login Flaw on Insurer's Live Website

Reflectiz's AI pentesting agent was mapping the login flow of a major insurer's production website, which has millions of users, when it found a critical-severity authentication bypass. The agent requested a login code and directed it to an email inbox it controlled. The code arrived, the login went through, and the agent's guardrails halted the test once the login succeeded. Reflectiz reported the issue to the insurer.

The flaw was simple. A one-time passcode (OTP) only proves identity if it goes to a contact already linked to the account. Here, the login request carried two fields that decided delivery: the channel and the address. Normally the code was sent by text to the phone number on the account. But if the channel was switched to email, the server sent the code to whatever address the request named. It never checked that the address belonged to the account. Per the source, an attacker with the required customer identifiers could potentially use this to access that customer's account.

The agent began with reconnaissance, reviewing the site's JavaScript and the API calls behind its pages, which surfaced two values that appeared to control how and where the code was sent. Such values only suggest a hypothesis, so the agent built a targeted test and ran it through the live login flow to confirm the bypass. This is a partial account based on the opening of the original article.