Easy Part Authentication Bypass

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it

What Happened

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it

Why This Matters

The evidence matters to defenders using Easy Part because it could allow access without the expected authentication controls.

Recommended Action

Confirm whether Found is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Timeline

• Incident first seen
  Oct 14, 2026 16:30

  BugSkan first recorded this incident.

• An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
  Oct 14, 2026 16:30

  thehackernews.com · Vulnerability

Sources

My Interests Match