| Titolo | Releasit COD Form & Upsells prior to v2 (client-side OTP validation) Improper Authentication |
|---|
| Descrizione | A vulnerability was identified in Releasit COD Form & Upsells, a Cash-on-Delivery form application for Shopify storefronts. In the affected version, OTP phone verification was enforced entirely on the client side. A static symmetric key was shipped in cleartext inside the application's client-side JavaScript bundle. The value used to validate the OTP was returned in the OTP-request network response, so the correct OTP was derivable in the browser using the embedded key. Order creation then proceeded with no server-side confirmation that an OTP had been delivered to, or entered by, the legitimate phone owner, making the verification fully bypassable.
Impact: a Cash-on-Delivery order could be placed without controlling the target phone number or receiving any SMS, defeating the application's anti-fraud control.
Classification: CWE-602 (Client-Side Enforcement of Server-Side Security) and CWE-321/CWE-798 (Use of a Hard-coded Cryptographic Key). CVSS 3.1 base score 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).
The vendor was contacted on 2026-02-20 and acknowledged the issue in writing, stating it had been previously identified by their security team and would be addressed in the v2 form. A server-side validation refactor was subsequently observed in place. A CVE request (MITRE #1999827) was filed on 2026-03-01 but was closed without a CVE being assigned.
Exploit-enabling detail (key value, derivation routine, live tokens) is deliberately withheld. Testing was performed exclusively on the researcher's own test store; no third-party systems or data were accessed.
Full redacted advisory: https://github.com/chetansaini53/releasit-cod-otp-bypass-advisory
Discoverer: Chetan Saini
|
|---|
| Fonte | ⚠️ https://github.com/chetansaini53/releasit-cod-otp-bypass-advisory |
|---|
| Utente | cyberac1d (UID 99595) |
|---|
| Sottomissione | 07/07/2026 12:23 (2 mesi fa) |
|---|
| Moderazione | 01/09/2026 09:09 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 397555 [Releasit Releasit COD Form & Upsells v1 OTP Validation] |
|---|
| Punti | 20 |
|---|