An authorised security assessment has reportedly uncovered a critical one-time passcode (OTP) bypass on a live insurance website, with the issue identified by an AI-based pentesting agent. According to the report, a login request allowed the user to choose where the sign-in code was delivered, creating a potentially serious weakness in the authentication flow.

The published account describes a simple attack path but a more difficult validation process because the flaw existed in a production environment. Although the report concerns a specific case, it is relevant more broadly for European businesses running customer logins, account recovery flows and multi-factor authentication on public-facing websites.

What happened

The source says the vulnerability was found during an authorised assessment on a major insurer's production website. The reported weakness was in the login process: a request allegedly let the user control where the OTP was sent. If confirmed, that kind of design flaw can undermine the purpose of OTP-based verification, because the system may trust user-supplied routing data instead of securely binding the code to the legitimate account holder's contact details.

The article frames the discovery as notable not only because of the authentication issue itself, but because an AI pentesting agent found it autonomously during a permitted test. The source does not establish that this is a widespread issue across the sector, and the report should be read as a documented case rather than evidence of a common industry-wide pattern.

Why it matters for European businesses

For European companies, the main lesson is not the insurer involved but the class of weakness. Many organisations rely on OTPs for customer portals, employee access, e-commerce accounts, partner extranets and password reset processes. If the destination of a code can be influenced by the user or manipulated in the application flow, the protection offered by multi-factor or step-up verification can be substantially reduced.

This matters especially for businesses that have:

• custom-built login and account recovery processes
• legacy web applications connected to newer identity layers
• consumer self-service portals handling personal or financial data
• rapidly deployed digital products where authentication logic was not thoroughly reviewed
• high volumes of API traffic between frontend systems and identity services

The report also points to a second practical issue: AI-assisted security testing is becoming more capable at finding business-logic flaws, not just technical misconfigurations. For security and IT teams, that creates both an opportunity and a warning. Defenders can use AI-enabled testing to identify subtle authentication weaknesses faster, but attackers may also increasingly automate the discovery of similar flaws.

Who may be affected

The immediate risk is highest for organisations that operate public-facing authentication systems tied to sensitive accounts or regulated data. This can include insurers, banks, healthcare platforms, SaaS providers, e-commerce businesses and any company offering customer dashboards or employee self-service access.

Teams most likely to be affected include:

• IT and security teams responsible for identity, access control and web application security
• digital product teams building sign-up, login and recovery journeys
• e-commerce operators managing customer accounts and transaction-related authentication
• regulated businesses where account compromise could have compliance and reporting consequences
• agency and development partners maintaining authentication flows for clients

For SMEs, the risk is not limited to large enterprises. Smaller firms often depend on third-party plugins, custom integrations or outsourced development, which can introduce logic flaws if authentication flows are not tested end to end.

What companies should consider

Businesses do not need to assume their OTP implementation is unsafe, but they should review whether their authentication flow securely binds verification steps to trusted account attributes stored server-side.

• Review login, registration and password-reset flows for any point where a user can influence the delivery destination of an OTP or verification code.
• Test whether client-side parameters, hidden fields or API requests can override email addresses, phone numbers or account identifiers during authentication.
• Validate that security-critical decisions are enforced server-side and are not based solely on frontend-supplied values.
• Include business-logic testing in web security assessments, not only standard vulnerability scanning.
• Ask development suppliers, agencies or platform vendors how authentication flows are tested in staging and production-like environments.
• Consider whether AI-assisted security testing can complement manual penetration testing, especially for complex user journeys and API-driven applications.
• Prepare an escalation process for production findings so that serious authentication issues can be verified and fixed quickly with appropriate safeguards.

For European organisations handling personal data, an authentication flaw can also create broader operational and compliance risk if it leads to unauthorised account access. The practical takeaway is straightforward: OTP and multi-factor mechanisms should be tested as complete workflows, not treated as inherently secure simply because a second step exists.