2FA Bypass By Response Manipulation

Hey, fellow hackers! In this blog post I’ll share how I found a simple bypass for two-factor authentication (2FA) using simple trick. This bug allowed me to access the user account without using the correct OTP (one time password).

Discovery: The 2FA Bypass Vulnerability

When I started testing on the target, I found the site lets users to set 2FA mechanism for added security. Some developers make mistake of verifying the OTP’s on client side and forgets to validate them on server side. This creates a perfect setup for attackers to bypass this functionality by manipulating responses.
I then quickly started to test this functionality to see if the OTP validation was properly implemented.

I created a user account, enabled a two factor authentication then logged out.I logged in again and this time the system asked for the OTP to complete the authentication.I entered correct OTP and intercepted the request to see what response server sends for correct OTP, I copied the response and saved it for later use.

4. Now, I logged out of the account, and started the login flow again.

5. This time I entered the wrong OTP(e.g.000000) and intercepted the request and response.

6. The response showed an error indicating that OTP is incorrect.

7. I quickly replaced the response with the previously saved successful one and forwarded it.

8. And BOOM! I was successfully logged in even using incorrect OTP.

📜 Impact

This vulnerability allows an attacker to completely bypass 2FA, potentially taking over user accounts. Even though 2FA is implemented as an additional security layer, this bypass completely nullifies its purpose, making accounts as vulnerable as those without 2FA.

💡 Takeaways

The whole point of 2FA is to protect users even if their credentials are compromised, but with this flaw, an attacker can log in as a user without needing a valid OTP. This turns what should be an additional security layer into a mere illusion of security.
This is a classic example of why client-side validation is never enough. Security should always be enforced server-side, and developers need to be mindful of how responses are handled.

Happy hacking! 🦆