eMudhra's one-time-password login can be bypassed by anyone with its public key
A complete bypass of eMudhra’s 1FA OTP login system
A Mastodon user demonstrates a complete bypass of eMudhra's one-factor OTP login. The service encrypts OTPs to a public key and gates requests behind Cloudflare Turnstile, but the key is public, so an attacker can encrypt OTP requests themselves. Brute-forcing is fast and needs only one Turnstile pass. By OSINTing the email tied to a certificate, someone could log into any existing eMudhra cert account.
It's not as cool as a leaked CA cert key, but you can basically just rob any existing eMudhra cert with this by just OSINTing the associated email and logging in.