Tata’s B2B platform returned OTPs in API responses
If you have ever logged into a website or app, odds are you get an OTP (one-time-password) sent to you via email or SMS. In recent months I have found a spate of insecure OTP implementations that can be bypassed to enable account takeover. This is one such case that I discovered in Tata nexarc. Believe it or not, they returned the OTP to you in the API responses – enabling account takeover just by knowing a target’s phone number.
Tata nexarc
Tata nexarc is a B2B platform in India that helps small and medium businesses procure steel and building materials from trusted/verified sellers. It is nothing particularly exciting, but with 55k followers on LinkedIn and 175k on Facebook, it seems to be reasonably popular.
Tata to your OTP!
The vulnerability was so simple it’s almost unbelievable. All you needed was a web browser and a few clicks to take over anyone’s account. When you log in, it sends what is possibly the most descriptive API call ever: “CheckForUsersRegisteredWithEmailOrMobileNoAndSendOTP.do”.
There’s a problem though: the API is encrypted, so in order to see what the response looks like, we need to decrypt it. The encryption and decryption is handled via client-side Javascript in global filters, and it is AES:
Instead of working on code to decrypt it myself, I set a breakpoint in the code that parses this particular API response to see what the plaintext looked like:
“otpGeneratedForMobile” was there. This is the OTP sent to the phone number. I could just copy that OTP and log into the account! No need to phish the OTP from the user or bruteforce it when the API generously gives it out. 😎 To make matters worse, that field wasn’t used anywhere, so they sent back the OTP for no reason.
The all-7s phone number was just a guess and it ended up being the main one for Tata Business Hub. It had admin privileges so I could modify the corporate page, manage employees, view the order history, and many other things.
Impact Showcase
I also came across a phone number linked to Tata Steel and used it to gain admin access to their account:
And that is about it. I could not find a way to mass-exfiltrate any database of phone numbers, so I had to dig deep on Google or rely on phone numbers visible in the “Manage Employees” page that could possibly be linked to other companies.
Timeline
Special thanks to India’s Computer Emergency Response Team (CERT-IN) for working with me on this disclosure.
This might be the shortest timeline on this blog so far!
- July 30, 2026: Reported to CERT-IN. They acknowledge the report same-day.
- July 31, 2026: CERT-IN confirms the vulnerability is fixed. “otpGeneratedForMobile” is no longer included in the API response.
- August 24, 2026: Published