bypass two-factor authentication in Android apps and web

Summary

A vulnerability was found where a random timeout issue on a Two-Step Verification endpoint could have resulted in a potential bypass of authentication if multiple incorrect attempts were entered in quick succession. It was found that this vulnerability required access to the user's email/password or phone number/code associated with the account and multiple bruteforcing attempts to bypass would be needed.

"The video POC is posted in the links below"

https://twitter.com/lu3ky13 https://www.linkedin.com/in/lu3ky13/ https://www.youtube.com/@cybershieldteam/videos [Ahmad A Abdulla – Medium][NY Times]. [ny times]: https://medium.com/@ahmadaabdulla

Thanks. .