Actions
SQA #3372
open[SQA] Testing on API Critical Security Vulnerabilities Identified - OTP Abuse, Account Takeover, and Data Exposure
Description
Summary¶
- OTP API Abuse: Missing rate limit allows for denial of service and account enumeration.
- Account Takeover: The password change endpoint vulnerable to unauthorized password resets.
- Data Exposure: Sensitive user data (personal, financial) exposed via account history endpoint.
- Severity: All vulnerabilities are classified as critical, requiring immediate attention.
Updated by Aman Bhuiyan 6 months ago
- % Done changed from 0 to 30
- Estimated time set to 15:00 h
Updated by Tasfia Zaima 6 months ago
- Status changed from Pending to Complete
- % Done changed from 30 to 100
Actions