Improper Access Control - Generic (CWE-284)CVSS 4.8
2FA Bypass Despite Fix via Manual Injection of isVerifyAuth Cookie in Local Storage
After an initial 2FA bypass vulnerability was “fixed” by removing the isVerifyAuth cookie from local storage, the application still trusted this value if it existed.
Scenario Analysis
Upon successful login with valid credentials, users are redirected to the OTP verification page at:
example.com/customer/verify-otp
During my initial inspection using DevTools, I verified the presence of the isVerifyAuth cookie, which was previously set to false. The company had removed this cookie from local storage as part of their security patch, resulting in its absence by default.
However, the application still accepted the cookie if it was manually reintroduced.