“If I were them, I would not want a random stranger having access to their corporate cloud for 5 months.”
Toyota Tsusho Insurance Broker India’s premium calculator API had no authentication and returned a base64-encoded email password. That opened a Microsoft account with no 2FA and about 657,000 emails, including policy PDFs, password reset links and OTPs. CERT-In got the report on August 7, 2023. Five months later the password still worked.