An investigation by independent researcher Srikanth L has revealed that the Institute for Development and Research in Banking Technology (IDRBT) domain registration portal (registrar.idrbt.ac.in) exposed sensitive data of 5,576 bank employees for at least 13 months due to critical security vulnerabilities.
What Changed
The vulnerability stemmed from 33+ unauthenticated API endpoints on the registrar.idrbt.ac.in portal, which allowed anyone to query the system without authentication. This exposure leaked bcrypt password hashes, mobile numbers, email addresses, login IPs, and device fingerprints of bank employees responsible for managing India's banking domains. Following the report, CERT-In addressed the vulnerabilities within 17 days.
Who Is Affected
The primary impact group includes the 5,576 bank employees whose credentials and personal identifiers were exposed. Additionally, the investigation highlighted administrative failures involving the private vendor IKCON Technologies, which held 22 employee accounts on the portal, including three with "Super Admin" access. The report also identified 1,072 "orphan" Super Admin accounts with no traceable owners.
Operational Impact
The exposure of bcrypt hashes poses a significant risk, as these can be cracked using sufficient computing power, potentially allowing attackers to hijack administrative accounts. Such access could enable the spoofing of legitimate banking websites or the issuance of fraudulent '.bank.in' domains. Furthermore, the report noted data residency violations where several cooperative banks hosted '.bank.in' websites on foreign servers, contradicting RBI data localisation mandates.
Bank compliance and security teams should immediately audit their administrative access protocols and ensure all domain-related credentials and hosting environments adhere to RBI data localisation and cybersecurity standards.
Source: Explained: How vulnerabilities in RBI's bank.in registry exposed sensitive data for 13 months
Domain: medianama.com
Comments load interactively on the live page.