Muhammad FaqihApplication security · Penetration testing
Test case 04 / 19FAIL

Improper Inventory Management - Authentication - OTP Endpoint Versions

Lab environment — not a production system

Screenshots and raw traffic are not translated; text within them may be in another language.

crAPI/Evidence/[FAIL] Improper Inventory Management - Authentication - OTP Endpoint Versions

01 — Notes

Test notes

Vulnerability

[FAIL] Improper Inventory Management - Authentication - OTP Endpoint Versions

Description

The OTP verification endpoint exists in several versions that are active at the same time: the older /identity/api/auth/v2/check-otp still works alongside the current v3. Retired/undocumented versions enlarge the attack surface and may enforce different security controls.

Impact

Confidentiality & Integrity: the still-live legacy version widens the attack surface; an attacker can pick the version with the weakest protection (e.g. for OTP brute force).

CWE

CWE-1059: Insufficient Technical Documentation (related to CWE-1104: Use of Unmaintained Third Party Components / legacy versions)

OWASP

API9:2023 - Improper Inventory Management

Scenario

v3 (the current version) is active. Exploitation: v2 (the legacy version) is also still active -> improper inventory (the legacy version was never decommissioned).

Endpoint

POST http://127.0.0.1:8888/identity/api/auth/v2/check-otp POST http://127.0.0.1:8888/identity/api/auth/v3/check-otp

Affected feature

Password Reset via OTP (crapi-identity)

Remediation

- Disable/retire legacy API versions (v2) that are no longer used. - Maintain an API version inventory and document the active endpoints. - Apply uniform security controls across every version still in service.

Proof of concept

1) (Screenshot 1) POST /identity/api/auth/v3/check-otp (current version) -> responds. 2) (Screenshot 2) POST /identity/api/auth/v2/check-otp (LEGACY version) -> still responds (Invalid OTP), proving the legacy version has not been decommissioned.
View source note (English)
Vulnerability: [FAIL] Improper Inventory Management - Authentication - OTP Endpoint Versions

Description:
The OTP verification endpoint exists in several versions that are active at the same time: the older /identity/api/auth/v2/check-otp still works alongside the current v3. Retired/undocumented versions enlarge the attack surface and may enforce different security controls.

Impact:
Confidentiality & Integrity: the still-live legacy version widens the attack surface; an attacker can pick the version with the weakest protection (e.g. for OTP brute force).

CWE:
CWE-1059: Insufficient Technical Documentation (related to CWE-1104: Use of Unmaintained Third Party Components / legacy versions)

OWASP:
API9:2023 - Improper Inventory Management

Scenario:
v3 (the current version) is active. Exploitation: v2 (the legacy version) is also still active -> improper inventory (the legacy version was never decommissioned).

Endpoint:
POST http://127.0.0.1:8888/identity/api/auth/v2/check-otp
POST http://127.0.0.1:8888/identity/api/auth/v3/check-otp

Affected Feature:
Password Reset via OTP (crapi-identity)

Remediation:
- Disable/retire legacy API versions (v2) that are no longer used.
- Maintain an API version inventory and document the active endpoints.
- Apply uniform security controls across every version still in service.

POC:
1) (Screenshot 1) POST /identity/api/auth/v3/check-otp (current version) -> responds.
2) (Screenshot 2) POST /identity/api/auth/v2/check-otp (LEGACY version) -> still responds (Invalid OTP), proving the legacy version has not been decommissioned.

02 — Screenshots

Screenshots (2)

01 / Current version: v3/check-otp

The latest version of the OTP verification endpoint (v3) is active.

02 / Observation: older v2 remains active

Impact: the older v2/check-otp endpoint remains active alongside v3, expanding the attack surface. Its protections may differ from v3 or be weaker; this capture does not establish a bypass.

03 — Requests and responses

HTTP captures

Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.

CAPTURE 01 / 1Current version: v3/check-otp
HTTP request
POST /identity/api/auth/v3/check-otp HTTP/1.1
Host: 127.0.0.1:8888
Content-Type: application/json

{"email":"[REDACTED-EMAIL]","otp":"0000","password":"[REDACTED-LAB-VALUE]"}
HTTP response
HTTP/1.1 500
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 58

{
  "message": "Invalid OTP! Please try again..",
  "status": 500
}

The latest version of the OTP verification endpoint (v3) is active.

CAPTURE 02 / 2Observation: older v2 remains active
HTTP request
POST /identity/api/auth/v2/check-otp HTTP/1.1
Host: 127.0.0.1:8888
Content-Type: application/json

{"email":"[REDACTED-EMAIL]","otp":"0000","password":"[REDACTED-LAB-VALUE]"}
HTTP response
HTTP/1.1 500
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 58

{
  "message": "Invalid OTP! Please try again..",
  "status": 500
}

Impact: the older v2/check-otp endpoint remains active alongside v3, expanding the attack surface. Its protections may differ from v3 or be weaker; this capture does not establish a bypass.