nic-delhi / AarogyaSetu_Android

Aarogya Setu Android app native code
https://www.aarogyasetu.gov.in/
Other
2.89k stars 1.96k forks source link

OTP validity mismatch #553

Open vazeem993 opened 3 years ago

vazeem993 commented 3 years ago

Both the Arogya Setu App and the OTP message received showing different OTP Valid time length, which attackers can take advantage. Also OTP Validity timing is really high, which should be reduced inorder to prevent unauthenticated access.