Thanks for appreciation Yugesh. The mitigation here is simple, there was no server side validation hence server side validation for the OTP should be implemented in this case. You can dm to my twitter any time. ☺