TATA'S B2B PLATFORM RETURNED OTPS IN API RESPONSES

Summary from the TLDR InfoSec newsletter

Tata nexarc's login API returned the OTP directly in its response body, letting researcher Eaton take over any account, including Tata Steel's own, just by knowing the target's phone number, until CERT-IN confirmed a fix on July 31.