LMFAOO<sup>O<sup>O<sup>O<sup>O<sup>O<sup>O<sup>O</sup></sup></sup></sup></sup></sup></sup>
https://eaton-works.com/2026/08/24/tata-nexarc-hack/
> If you have ever logged into a website or app, odds are you get an OTP (one-time-password) sent to you via email or SMS. In recent months I have found a spate of insecure OTP implementations that can be bypassed to enable account takeover. This is one such case that I discovered in Tata nexarc. Believe it or not, they returned the OTP to you in the API responses – enabling account takeover just by knowing a target’s phone number.
:rainbowCrow:
npub1s6…8n008
2026-08-24 14:44:45 UTC
Author Public Key
npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008Published at
2026-08-24 14:44:45 UTCEvent JSON
{
"id": "e88d6a660ca048cdd37b71648cb183d576cd67827f201ad3627901c23c347e20",
"pubkey": "86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac",
"created_at": 1787582685,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@cR0w/117151018904810218",
"web"
],
[
"proxy",
"https://infosec.exchange/users/cR0w/statuses/117151018904810218",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/cR0w/statuses/117151018904810218",
"pink.momostr"
],
[
"-"
]
],
"content": "LMFAOO\u003csup\u003eO\u003csup\u003eO\u003csup\u003eO\u003csup\u003eO\u003csup\u003eO\u003csup\u003eO\u003csup\u003eO\u003c/sup\u003e\u003c/sup\u003e\u003c/sup\u003e\u003c/sup\u003e\u003c/sup\u003e\u003c/sup\u003e\u003c/sup\u003e\n\nhttps://eaton-works.com/2026/08/24/tata-nexarc-hack/\n\n\u003e If you have ever logged into a website or app, odds are you get an OTP (one-time-password) sent to you via email or SMS. In recent months I have found a spate of insecure OTP implementations that can be bypassed to enable account takeover. This is one such case that I discovered in Tata nexarc. Believe it or not, they returned the OTP to you in the API responses – enabling account takeover just by knowing a target’s phone number.",
"sig": "d17b0a16733611c28465541a445c2882975bd73b4e6039bd467ebb06f403d39fd136b67af114922f4aa64b1519b96760118686fd23f2c8333bb5941d69ab6e76"
}