Description

A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version v2 is able to resolve this issue. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T15:17:40.983Z",
  "pubdate": "2026-09-01T15:17:40.983Z",
  "executiveSummary": "Releasit Releasit COD Form & Upsells v1 is vulnerable to a security misconfiguration involving client-side enforcement of server-side security logic within the OTP Validation component.\nThis vulnerability allows remote, unauthenticated attackers to bypass critical validation checks intended to verify One-Time Passwords (OTP).\nBy manipulating the client-side state or intercepting and modifying server responses, an attacker can circumvent the authentication or verification process without providing a valid code.\nThe risk implication is significant as it undermines the integrity of the COD (Cash on Delivery) verification mechanism, potentially leading to fraudulent orders and unauthorized account interactions.\nThe vulnerability is currently exploited in the wild, necessitating immediate remedial action to prevent service abuse.\nUpgrading to version v2 is required to address the identified flaw, as the current implementation fails to properly validate OTPs on the backend, relying instead on client-side controls that are easily circumvented by malicious actors.",
  "technicalDetails": "The vulnerability originates from an architectural flaw within the OTP Validation component of Releasit Releasit COD Form & Upsells v1, where the application incorrectly delegates trust to the client-side environment for security-critical decisions.\nThe root cause is a breakdown in the server-side verification loop; rather than performing cryptographic verification or session-based state validation of the OTP on the server, the application permits the client to dictate the success or failure of the validation process.\nThe attack flow typically involves an attacker initiating a checkout or form submission process that triggers an OTP request. Upon receiving the prompt for the code, the attacker intercepts the HTTP transaction via a proxy or manipulates the browser's Document Object Model (DOM) to bypass the validation logic.\nBecause the server-side component fails to independently verify the authenticity and validity of the OTP, the attacker can submit arbitrary values or manipulate the client-side response flags (e.g., changing 'success: false' to 'success: true' in a JSON response).\nThe server, lacking server-side enforcement, treats the manipulated client state as a valid authorization, thereby confirming the OTP validation without the user ever possessing the actual code.\nThis flaw allows for remote exploitation without requiring prior authentication. The attacker does not need access to the user's communication channels (SMS/Email) where the OTP is sent, as the entire validation handshake is susceptible to client-side manipulation.\nThe impact of this exploit is severe, as it bypasses the primary security control meant to verify the legitimacy of a user's contact information and intent before processing a COD order.\nPost-exploitation, attackers can successfully submit fraudulent orders, bypass anti-spam measures, and commit identity fraud by masquerading as legitimate users through the abused COD form.\nVersion v1 is confirmed as affected, and the vulnerability is currently publicly disclosed, increasing the likelihood of widespread exploitation. The deficiency resides in the design of the OTP validation flow, requiring a patch that enforces strict server-side validation and state management, which is addressed in the transition to version v2."
}