Tata Nexarc B2B Platform Vulnerability Allowed Account Takeover via Phone Number
A critical flaw in Tata's B2B procurement platform, Nexarc, allowed attackers to take over accounts using only a registered phone number by exploiting how one-time passwords (OTPs) were handled.
A significant authentication vulnerability has been discovered in Tata Nexarc, a business-to-business procurement platform catering to small and medium-sized enterprises in India. The flaw enabled attackers to gain unauthorized access to user accounts, including those with administrator privileges, by leveraging only the victim's registered mobile number.
The core of the vulnerability lay in the platform's handling of one-time passwords (OTPs) used for login. Instead of solely relying on SMS delivery for verification, the platform's API endpoint, CheckForUsersRegisteredWithEmailOrMobileNoAndSendOTP.do, inadvertently returned the generated OTP directly within its response. While the API traffic was encrypted, the decryption logic was implemented in client-side JavaScript. A security researcher was able to intercept and decrypt this response using a browser breakpoint, revealing the plaintext OTP.
This exposure effectively bypassed the intended security mechanism of OTPs, which are designed to confirm control over a registered phone number. By retrieving the OTP from the API response, an attacker could complete the login process as the legitimate user without needing to intercept SMS messages, engage in phishing, or perform brute-force attacks. The vulnerability was described as a client-side secret disclosure, as the OTP was unnecessarily exposed to the requesting browser.
The potential impact of this flaw was severe. In testing, a guessed mobile number was linked to the primary account of Tata Business Hub, which held administrator privileges. This level of access could allow an attacker to manage corporate pages, administer employee accounts, view sensitive order history, manage subscriptions and licenses, and access marketplace functions. The researcher also reported gaining administrator access to an account associated with Tata Steel using a phone number linked to that organization.
While the disclosure did not detail a method for mass extraction of phone numbers from the platform, attackers could potentially identify targets through publicly available information or by compromising other accounts to reveal employee phone numbers. The vulnerability's exploitability was thus limited to targeted attacks rather than widespread, automated exploitation.
Upon discovery, the vulnerability was promptly reported to India's Computer Emergency Response Team (CERT-In) on July 30, 2026. CERT-In acknowledged the report and confirmed that the issue was resolved the following day, July 31, 2026. The vulnerable otpGeneratedForMobile field was removed from the API response, effectively closing the security gap.
This incident serves as a stark reminder of fundamental security principles in OTP implementation. Authentication codes should never be returned to the client, logged in plaintext, or exposed through browser-accessible APIs. Secure systems must validate OTPs server-side, minimize data in responses, enforce strict expiry and rate limits, and implement robust monitoring for suspicious authentication activities to prevent account takeover attempts.