Tata’s B2B Platform Flaw Enables Account Takeover Just by Knowing Victim’s Phone Number

A critical authentication flaw in Tata Nexarc, a B2B procurement platform for small and medium businesses in India, allowed attackers to take over accounts by knowing only a registered mobile number.

The platform reportedly exposed the one-time password used for login within a decryptable API response, removing the need to intercept SMS messages, phish users, or brute-force OTPs. Tata Nexarc connects businesses with sellers of steel and building materials.

A security researcher disclosed that its OTP-based login flow called an endpoint named CheckForUsersRegisteredWithEmailOrMobileNoAndSendOTP.do, which initiated OTP delivery to the supplied mobile number. However, the same process also returned the generated OTP to the client.

Although the relevant API traffic was encrypted, the encryption and decryption logic reportedly ran in client-side JavaScript using AES. Because the browser needed to decrypt the response to process it, the researcher used a breakpoint in the JavaScript handling the API response to view the plaintext data.

Tata’s B2B Platform Vulnerability

The decrypted response included a field named otpGeneratedForMobile. That field contained the exact OTP sent through SMS to the account holder’s phone.

An attacker could submit a target’s mobile number, retrieve the OTP from the API response, and use it to complete the login flow as that user. The issue effectively turned an OTP authentication mechanism into a client-side secret disclosure vulnerability.

OTPs are intended to act as proof that a user controls a phone number or email inbox. Returning the code in a response accessible to the requesting browser defeats that protection entirely.

The researcher said the application’s visible login functionality did not need the exposed OTP field. Its presence in the response therefore created unnecessary risk with no apparent operational benefit.

Eaton-Works reports that the impact could be severe based on the affected account’s privileges. Testing revealed that a guessed mobile number was linked to Tata Business Hub’s primary account, which had administrator access.

Access reportedly enabled management of a corporate page, employee administration, viewing order history, subscription access, licenses, shipment details, proposals, marketplace functions, and notifications.

The researcher also reported gaining administrator access to an account linked to Tata Steel using a mobile number associated with that organization. The disclosure did not describe a method for bulk extraction of platform phone numbers, which limited mass exploitation.

However, attackers could identify targets through public sources or phone numbers exposed on employee management pages after compromising another account.

The vulnerability was reported to India’s Computer Emergency Response Team, CERT-In, on July 30, 2026. CERT-In acknowledged the report the same day and confirmed the issue was fixed on July 31, 2026.

The vulnerable otpGeneratedForMobile field was removed from the API response, according to the researcher’s disclosure published on August 24.

The case highlights a fundamental OTP implementation rule: authentication codes must never be returned to the client, logged in plaintext, or exposed through browser-accessible APIs.

Servers should validate OTPs internally, minimize response data, enforce expiry and rate limits, and monitor authentication activity for account takeover attempts.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC