Vulnerability Fixation
Non Time Bound and Reusable OTPs

OTPs are often seen as a way to enhance security, as they are typically valid for a short period and can only be used once. A critical vulnerability arises when OTPs are neither time-bound nor one-time usable, allowing them to be used multiple times and exposing the application to brute-force attacks.

To mitigate this, OTPs should always have strict expiration times and be invalidated immediately after use. Implementing rate limiting, retry restrictions, and server-side validation further ensures that attackers cannot reuse or guess OTPs through automated or brute-force attempts.