External risk intelligence

Mahadiscom Mahavitaran Android OTP Fixation Vulnerability Allows Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2021-41716

The vulnerability exists within a specific mobile Android application. Mobile applications typically function as client-side software rather than network-accessible services, making them very unlikely to be exposed as public-facing internet services or network-reachable gateways.

Authentication Bypass

Mahadiscom Mahavitaran

7.50 and earlier

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Mahavitaran Android application could allow unauthorized remote account takeover by exploiting a weakness in the password reset function. This issue affects versions prior to 8.20 of the application.

Remote account takeover via password reset weakness.
Critical flaw in a widely used mobile application.
Confirm relevance and exposure for business systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability remotely by targeting users of the Mahavitara Android application. The flaw lies within the password reset function, specifically how One-Time Passwords (OTPs) are handled. By manipulating the OTP, an attacker could potentially gain unauthorized access to a user's account.

No prior access needed.
Fixating OTP during reset.
Remote account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Mahavitaran Android application could allow an attacker to take over a user's account. This could happen if an attacker can intercept or guess the One-Time Password (OTP) used during the password reset process.

User account access.
OTP fixation during password reset.
Unauthorized account control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Mahavitaran Android application's OTP fixation vulnerability requires immediate attention from teams managing the application and its user base. The first practical step is to identify all instances of the affected application, determine their exposure and criticality, and locate the accountable owner for remediation planning.

Application owners should verify exposure.
Confirm user impact and critical functions.
Plan vendor coordination for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mahavitaran Android application?

Mahavitaran is the official mobile application for the Maharashtra State Electricity Board. It allows electricity consumers to manage their accounts, view bills, and handle service requests directly from their Android devices.

What does OTP fixation mean in CVE-2021-41716?

This vulnerability is classified as CWE-287, which relates to improper authentication. In this context, it means the application fails to properly secure the password reset process. An attacker can manipulate or 'fix' the One-Time Password used to verify a user's identity, effectively bypassing the security check and gaining unauthorized access to an account.

How can an attacker trigger this vulnerability?

The attack occurs during the password reset flow. An attacker must interact with the password recovery function to manipulate the expected OTP value. It is important to note that simply using the app for normal account management does not trigger the bug; the vulnerability is specific to the handling of verification tokens during the reset process.

Is this vulnerability reachable from the internet?

Halo Surface Signal indicates this is very unlikely. Because Mahavitaran is a mobile application, it operates as client-side software on user devices rather than a public-facing network server or gateway. The risk is primarily contained within the application's local logic rather than a typical network-accessible service.

What should I do if I manage this application?

Prioritize identifying all deployed instances of the affected versions. Since this flaw involves account security, contact the vendor to confirm the availability of patches beyond version 8.20 and coordinate a rollout. Assess the criticality of the data accessed through the app to determine your internal urgency for these updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.