OTP Verification Bypass in Phone Number Change

Summary#

The phone number change functionality requires OTP verification before allowing the phone number to be updated.

However, the OTP can be bypassed by submitting an invalid OTP verification and then replaying the underlying UsersUpdatePhoneNumber GraphQL mutation without completing a successful OTP verification.

The server accepts the mutation and changes the phone number without validating that a valid OTP was successfully verified.

Steps to Reproduce#

1. Log in to a valid account.
2. Navigate to Account Settings and start changing the phone number.
3. Enter a new phone number.
4. The application requests an OTP verification code.
5. Submit an incorrect OTP.
6. Intercept the phone number update request using Burp Suite.
7. The request responsible for changing the phone number is: