Tata's B2B Platform Returned OTPs in API Responses

2026-08-25

Tata nexarc's login API returned the OTP directly in its response body, letting researcher Eaton take over any account, including Tata Steel's own, just by knowing the target's phone number, until CERT-IN confirmed a fix on July 31.