eMudhra Login Bypass Puts Certificates at Risk

This is a serious authentication failure, not merely an inconvenient login bug: one weak identity-verification step can expose high-value signing credentials and account actions.

• –The alleged bypass turns publicly discoverable email addresses into a path toward certificate-account compromise
• –eMudhra’s portal handles KYC, payments, certificate downloads, reissues, and transaction history, raising the stakes beyond ordinary web-account access
• –Developers should treat OTP-only authentication as insufficient for certificate operations and add phishing-resistant MFA, risk-based checks, and step-up verification
• –This issue is distinct from eMudhra’s separate compromised-CA-key incident, but both expose weaknesses in the company’s trust infrastructure