676,000 Trucks Behind an API With No Auth

The whole thing started with a URL the site was already calling.

My Eicher — the fleet portal that VE Commercial Vehicles, the Volvo Group/Eicher Motors joint venture, ships with its trucks and buses in India — hits an endpoint at /cepauthmgr/user/validateMobileNo when you type a phone number into the login box. Security researcher Eaton Zveare trimmed the last path segment. The server handed back an index of every route living under /cepauthmgr/user/. None of them asked for a token.

GET /cepauthmgr/user/validateMobileNo   # what the login page calls
GET /cepauthmgr/user/                   # → index of every route beneath it
GET /cepauthmgr/user/customers          # → 748,000 records, no auth

That's the vulnerability. Everything after it is enumeration: 174,000 user accounts, 186,000 person records, 676,000 vehicles, and 76,000 uploaded documents including Aadhaar cards and driving licences. Also an endpoint that returned roughly 2.5 million one-time passcodes, in plaintext, going back to 2021 — and a companion endpoint that would return the OTP for a specific mobile number. Account takeover was three requests long: trigger an OTP to someone else's phone, read it back off the API, log in as them. VECV patched it in 17 days.

Authorization that lived in the proxy

The route index is the tell. Nobody builds a self-describing listing of every handler for an internet-facing API. You build it because the consumer is another service inside your own network, and the security control is that there's no path to it from outside.

Then somebody needs the login flow on the public website, so they punch a hole in the reverse proxy for the two or three routes the web app actually calls. The service itself never changed. It still trusts everyone, because in its original deployment everyone was a peer service. What used to be network isolation is now a path-prefix allowlist in an nginx config, and a path prefix is a naming convention, not an authentication check. One overly broad location block and the entire internal surface is public.

This is the most common way large web platforms die, and it's not a coding mistake — it's an architectural one. Auth has to be deny-by-default in the service: every handler requires a resolved principal, public routes are an explicit list a human reviewed, and CI fails when a new route lands in neither bucket. If your service returns 200 to an unauthenticated request because "it's internal," you're one config change from this article.

The OTP table is the second lesson and the more embarrassing one. A one-time code is a credential with a five-minute lifetime. It should be hashed like a password, given a TTL that actually deletes it, rate-limited on issue and on verify, and reachable by exactly one code path — the verifier. Instead it was a permanent, queryable log of every login attempt anyone had made in four years. Try this against your own production database:

SELECT min(created_at), count(*) FROM otp_codes;

If the oldest row predates last Tuesday, you have this bug in a form that hasn't been found yet.

A fleet portal is worse than a car hack

When Sam Curry's team broke Kia's dealer portal in 2024, they could unlock and start a car from a licence plate in under 30 seconds, which is cinematic and made the rounds accordingly. This one is duller and, commercially, considerably worse.

To be precise about the blast radius: Zveare's writeup demonstrates control of the management plane, not the vehicle. Real-time positions, live gauge-cluster data, geofence configuration. There's no remote immobilisation, nothing on the CAN bus, no evidence anyone can stop a truck. Read that as reassurance if you like, but a logistics business isn't in the business of door locks. Its route network is the business — which customers, which corridors, which loads, which depots, in real time, across a fleet that can run to hundreds of vehicles under one account. Handed to a competitor, that's a pricing sheet. Handed to organised cargo theft, it's a targeting system with live coordinates. And the 76,000 identity documents sitting behind no auth at all are the highest-value PII class in India, full stop.

Worth noting the numbers don't line up with the marketing: VECV announced 275,000 connected vehicles and 115,000 customers in 2024, while the exposed tables held 676,000 vehicles and 748,000 customer records. Databases outlive deployments. Whatever your dashboard says is connected, assume the row count is two or three times larger.

The pattern isn't the vehicle, it's the portal

Zveare has now done this to Toyota's global supplier system — where a JWT could be minted from an email address alone, exposing 14,000 suppliers — and, at DEF CON last August, to an unnamed US automaker's dealer platform, where he escalated himself to national admin across 1,000+ dealerships and could remotely unlock and start customer vehicles. Add Kia's dealer portal. Four incidents, one shape: the vulnerable thing was never the car. It was the web application the manufacturer built around the car.

There's a structural reason. A telematics specialist like Samsara sells into enterprise procurement, which means surviving a security questionnaire, a pen-test clause and a SOC 2 review before anyone signs. An OEM's own portal is bundled free with the vehicle. No procurement gate, no security addendum, no customer who can plausibly churn because the API is undefended. It's the software an automaker ships without ever selling — and it's built by a team whose institutional muscle memory is manufacturing quality control, not adversarial review of an HTTP surface.

If you build one of these, the honest question isn't whether you have an IDOR. It's whether anyone has ever enumerated every route your gateway exposes and asserted an auth check on each one. Not tested the features. Enumerated the routes.

The disclosure is the part that should worry customers

Seventeen days from report to patch is respectable; plenty of larger companies do worse. Everything after that is the failure. Zveare reported on 3 November 2025, followed up twice into silence, watched the APIs go dark on 20 November, and then spent months failing to reach anyone who would look at his remaining concerns. No acknowledgement, no advisory, no CVE. The fleet operators whose drivers' Aadhaar scans were sitting unauthenticated on the public internet were never told.

The timing is almost too neat: India's DPDP Rules were notified that same month, carrying 72-hour breach notification and penalties up to ₹250 crore for failing to implement reasonable security safeguards. The core obligations phase in through May 2027, so this one lands squarely in the gap. The next one won't.

One caveat: this rests on a single researcher's account. VECV and Volvo haven't commented publicly, no independent party has verified the record counts, and there's no vendor advisory to check them against. Zveare's track record — Toyota, the dealer platform, all of it confirmed and fixed — is why I'd take the technical claims at close to face value anyway. But the record counts are his screenshots, not a disclosed breach report, and they should be read that way.