Ascertia SigningHub One-Time Password Verification Bypass Vulnerability

A rate limiting vulnerability has been identified in the One-Time Password (OTP) verification endpoint of Ascertia SigningHub version 8.6.8 and prior. This flaw allows attackers to automate OTP code submissions and bypass verification, potentially impersonating another user.

Impact

Exploitation of this vulnerability allows for unauthorized OTP verification, enabling attackers to impersonate users by verifying their mobile numbers without knowledge of the actual OTP codes.

Remediation

It is recommended to implement rate limiting on the OTP verification endpoint to prevent brute-force attacks. Additionally, OTP codes should be revoked after a certain number of failed verification attempts.