A Small Refresh Bug That Uncovered Security Gaps in My OTP System

The Bug That Started It All

It began as a small bug I found myself while testing: OTP verification kept failing whenever I refreshed the page, opened a new tab, or copied the link to open on another device. Easy to reproduce, and my first instinct was to blame the frontend — check the state management, fix it, done.

I was wrong. What looked like a 10-minute bug forced me to redesign how my entire OTP system stored data — and that redesign process is what uncovered a gap I had no idea was there.

Digging In: The Root Cause Was in the Frontend

The immediate cause was easy to spot. I was passing the email to the verification page like this:

A Small Refresh Bug That Uncovered Security Gaps in My OTP System

Related reading

4 Security Bugs I Found in My Own Auth System (And How I Fixed Them)

My app's anti-theft feature locked every user out

I Built a Security App. Then I Tried to Break It Myself.

From a Broken Side Project OAuth Bug to Enterprise SSO Token Exchange

When a "Simple Refresh" Broke Our Production App: Next.js Static Export on Azure

The Door I Forgot to Lock, How One Missing Check Nearly Exposed Every Resume in…