OTP bypass on Forgot password Page. response manipulation

Discovered a mobile number verification bypass via incorrect server side validation allowing an attacker to bypass OTP.

Vulnerable URL : https:***************/password/reset

##Description(Not critical)

This vulnerability allows attacker to bypass OPT with or without valid mobile number.

Steps to reproduce :

1. Go to reset password page.
2. Enter any/temp Email id.
3. enter 10 digit mobile number Ex. 1122334453.(you can modify numbers in captured request.
4. before pressing send OTP button turn “intercept on” in Burpsuite.
5. do intercept to Response to this request.

6. In response change key value as true and remove message.

7. Go to browser enter random OTP Ex.1122334455

8. Do same as above. Capture response to this request. Change key value. remove message. Forward it to browser.

9. You can see green color mark shows OPT verified.