Vulnerability Type: Incorrect Access Control / Token Misuse Impact: Critical – Full Account Takeover (ATO) Affected Product: Telekom Account Management Portal Affected Versions: Deployment before v.2025-10-27 Fixed In: 2025-10-31
Description: A flaw in the activation token validation mechanism allowed the reuse of previously issued or unbound tokens on the password-reset endpoint, enabling unauthorized password resets for targeted accounts.
Vulnerability Type: Incorrect Access Control / 2FA Bypass Impact: Critical – Multi-Factor Authentication Bypass Affected Product: Telekom Account Management Portal Affected Versions: Deployment before v.2025-10-24 Fixed In: 2025-11-03
Description: Insufficient server-side rate-limiting on the 2FA verification endpoint allowed attackers to bypass throttling controls via HTTP header manipulation, resulting in unlimited brute-force retries.
Discoverer: Rohit Kailas Pawar
Rohit Kailas Pawar, also known as Ethicalrohit, is a hacker and security researcher from India and an aspiring cybersecurity specialist and bug bounty hunter. With a strong passion for technology and expertise in vulnerability assessment and bug hunting, Rohit Kailas Pawar aims to safeguard digital assets and contribute to a more secure online community.
Rohit Kailas Pawar’s security research and responsible disclosures have been recognized by organizations such as NASA, BOLT, the U.S. Government, the Defense Nuclear Facilities Safety Board, Telekom, Fyers, among others, for identifying and reporting critical vulnerabilities.
LinkedIn: https://www.linkedin.com/in/ethicalrohitt/ X (Twitter): https://x.com/ethicalrohitt