SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Minor OTP Refresh Bug Exposes Brute-Force and Spam Vulnerabilities in Auth System

0
·1 views

A developer discovered a chain of security flaws in their OTP authentication system after investigating a seemingly minor bug where verification failed on page refresh or new tabs. The root cause was storing user email in React Router's in-memory state, which disappears on refresh, prompting a redesign toward a server-side token-based approach. During that redesign, three deeper issues emerged: no rate limiting on the verify endpoint, error messages that revealed whether an email was registered, and a completely unprotected OTP generation endpoint. The unguarded generation endpoint proved especially dangerous, as repeated calls could trigger costly SMS gateway charges and flood victims with unwanted notifications without requiring any credential guessing. The incident highlighted how a small frontend fix can surface systemic backend security gaps when examined thoroughly.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer loses 4 days of AI access, spends €200 after overnight automation hits hidden weekly cap

A developer running Claude Code on a flat monthly subscription lost access to the AI tool for four days after an overnight automation loop exhausted his weekly usage limit in just two days. He was unaware that Anthropic had added a weekly cap on top of the monthly one, having never approached either limit during normal use. To meet client deadlines mid-lockout, he purchased additional tokens at full list price, spending €200 over four days at reduced productivity. The incident exposed a blind spot: no tool was warning him in real time how quickly his weekly allowance was being consumed. He subsequently built a usage meter through four iterative attempts to surface that information in plain, actionable language.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AgentATC Uses OpenTelemetry to Expose Silent Failures in Multi-Agent AI Systems

AgentATC is an open-source project built for the 'Agents of SigNoz' Hackathon (WeMakeDevs × SigNoz, July 2026) that addresses a blind spot in AI observability: multi-agent coordination failures that produce no errors or alerts. The system runs a three-agent workflow — Planner, Executor, and Critic — to generate competitive analysis reports, where every inter-agent handoff is recorded as a first-class OpenTelemetry span. A single shared trace ID links all subtasks, preventing fragmented traces and making the full execution history visible in one connected view. To demonstrate the problem, one subtask is deliberately designed to loop endlessly, as the Executor can never satisfy the Critic's rubric, burning LLM tokens silently without triggering any exception or dashboard alert. AgentATC argues that traditional observability tools measure latency, errors, and cost per call, but are not designed to detect coordination breakdowns between agents.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Rust library ez-ffmpeg 0.15 offers single-call in-process video frame extraction

Extracting video frames in Rust for machine learning inference has long required either shelling out to FFmpeg via the command line or hand-writing a low-level decode loop spanning dozens of lines. The newly released ez-ffmpeg 0.15 introduces a FrameExtractor API that handles frame extraction in-process with a single function call, returning tightly packed RGB24 bytes ready for use with tensors or ndarray. The library supports flexible sampling strategies, including uniform frame distribution across a video clip, making it well-suited for vision-language model pipelines. A notable issue with many existing approaches — incorrect application of BT.601 color coefficients to HD video, causing subtle color distortion — is also addressed by the library. ez-ffmpeg links against libav through ffmpeg-next and requires FFmpeg 7.1 or later to be installed on the system.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Replicates Anthropic's Vision-Only Pokémon Claim, But Thinking Logs Raise Questions

A developer independently replicated Anthropic's claim that its Claude Fable 5 model can play Pokémon FireRed using only raw screenshots, building a matching harness that reached the first gym badge in 1,785 turns at a cost of $65.40. The experiment confirmed the core result is real, with full logs, frames, and harness code made publicly available for scrutiny. However, after examining the model's thinking chains, the developer found Claude was recalling memorized game knowledge — such as specific trainer dialogue and city objectives — rather than reasoning purely from visual input. The model had written down plot objectives 141 turns before they appeared on screen and identified off-screen trainer details by memory, suggesting its performance relies heavily on training data rather than vision-based reasoning. This raises questions about what 'vision-only' truly means in this context, as Anthropic published no harness code, step count, cost, or definition of 'minimal' alongside its original announcement.

0 comments Read more at DEV Community
Minor OTP Refresh Bug Exposes Brute-Force and Spam Vulnerabilities in Auth System · ShortSingh