# CVE-2025-56224 (OTP) verification Bypass
# Description
an attacker can impersonate another user mobile number and use this vulnerability to verify the number without knowing the OTP code.
------------------------------------------
# CVSS Score: 8.1 (High)
------------------------------------------
Attack Type
* Remote (Authenticated)
------------------------------------------
Affected Versions
* Versions before <= 8.6.8
------------------------------------------
Vendor of Product
* Ascertia
------------------------------------------
Affected Product Code Base
* SigningHub
------------------------------------------
Affected Component
* Mobile number verification function.
------------------------------------------
Mitigations
* Revoke the OTP code if a number of attempt passed certain value.
------------------------------------------
Vulnerability Details
* The application does not enforce proper rate limiting on the One-Time Password (OTP) verification endpoint. This allows an attacker to automate and brute-force OTP codes without restriction. By sending a high volume of OTP guesses in rapid succession, an attacker can potentially bypass the OTP verification mechanism of the mobile number.
------------------------------------------
Fixed versions
* Versions after > 8.6.8
------------------------------------------
Discovered By:
* Yazan Abu-Nadi
登录后查看神龙缓存的 POC 文件快照
登录查看