Account Takeover via OTP Bypass Through Response Manipulation — A Real-World Bug Finding

TL;DR: I discovered a critical vulnerability on tpl.com.bd that allows any unauthenticated attacker to fully take over any user account —…