Description

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The impact is amplified for accounts that have not configured a mobile number, as the enumeration is specifically tied to this condition. The discovery of these usernames can facilitate subsequent brute force attacks, social engineering attempts, and information leakage, potentially leading to reputational damage, loss of customer trust, and regulatory non-compliance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-15T10:17:00.877Z",
  "pubdate": "2026-09-15T10:17:00.877Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw within the SMS OTP initiation process, where the application exhibits distinct error responses based on whether a provided username corresponds to a registered account.\nCategorized as a username enumeration vulnerability, this flaw allows unauthorized actors to programmatically probe the system to identify valid user accounts.\nThe risk is significantly elevated for accounts lacking a configured mobile number, as the discrepancy in server responses serves as a reliable oracle for account existence.\nBy identifying valid usernames, an attacker can refine targeting for subsequent malicious activities, including credential stuffing, brute-force password spraying, and highly targeted social engineering campaigns.\nThe exploitation process requires no special privileges and can be performed remotely via standard network requests.\nFailure to remediate this issue may result in unauthorized data exposure, potential account takeovers, and non-compliance with data protection regulations requiring the minimization of metadata leakage.",
  "technicalDetails": "The root cause of this vulnerability is improper error handling within the SMS OTP initiation workflow. When an application provides different feedback—such as varying HTTP status codes, error messages, or response latency—based on whether the targeted user account exists, it creates an oracle that an attacker can query.\nThe attack flow begins with the attacker submitting a list of potential usernames or identifiers to the OTP initiation endpoint. For each request, the attacker monitors the application's response. If the application returns a specific error message (e.g., 'User not found' vs. 'OTP sent to mobile device') or observable differences in processing time, the attacker can verify the existence of the username.\nThe vulnerability is particularly impactful when the system logic attempts to trigger an SMS for a non-existent or unconfigured user. If the system confirms that no phone number is associated with an account in a way that differs from a non-existent account, the attacker can further isolate and enumerate valid users who have not yet configured security features.\nThis behavior facilitates a systematic enumeration of the user database. Because this process is automated and low-complexity, an attacker can verify thousands of usernames in a short timeframe without triggering traditional authentication failure thresholds, as the interaction occurs at the pre-authentication phase.\nPost-exploitation, the verified list of usernames acts as a high-value dataset. Attackers use this to optimize brute-force attacks, as they no longer waste resources testing invalid accounts. Furthermore, the leakage confirms valid organizational members, which is instrumental in crafting personalized phishing or vishing attacks aimed at bypassing additional security controls.\nThe vulnerability resides within the application's input validation and response generation logic during the initial OTP request phase. It is a logic flaw rather than a software bug, meaning it persists regardless of the underlying infrastructure if the API/interface design allows for the differentiation of account states."
}