Being given a permission by the task itself, he launched his automated scanner, feeding it authentication flows that relied on time-based tokens and push-based verification.
As RAZi systematically tested each login process, attempting session re-use and manipulating token expiration windows.
Within minutes, an anomaly surfaces and a backup code endpoint failed to enforce secondary verification when accessed under specific conditions.
He reran the exploit manually, bypassing the MFA prompt entirely while maintaining full session control.
Recognizing the severity, he deepened his analysis, probing for variations of the flaw across different account tiers.
RAZi then simulated multiple user scenarios, discovering two additional loopholes where expired tokens were mistakenly recognized as valid.
