Executive brief
Releasit COD Form & Upsells is a Shopify app that provides OTP phone verification as a fraud-prevention control for Cash-on-Delivery orders. The vulnerability allows attackers to forge OTP verification and place fraudulent COD orders without accessing the target phone number or receiving any SMS. This defeats the anti-fraud protection and exposes storefronts to payment fraud at scale.
Technical details
The vulnerability is a client-side enforcement of server-side security (CWE-602) combined with hard-coded cryptographic keys (CWE-798). The OTP validation was performed entirely in the browser using a static symmetric key embedded in plaintext within the app's client-side JavaScript bundle. An attacker could extract the key, derive a valid OTP from the validation value returned in the OTP-request response, and place an order without server-side verification. The attack requires only network access and is remotely exploitable with no authentication or user interaction; no reverse engineering was needed to locate the key. The vendor has patched the issue in v2 by moving OTP generation and validation to the server side.
Affected products
- Releasit COD Form & Upsells v1
Timeline
- 2026-09-01: disclosed: Advisory published
- 2026-09-01: patched: Fix available in v2