Improper Access Control allows OTP bypass