Zero‑Click ATO via Unbound Password‑Reset Token in one of the world’s largest gambling platforms

How a single-use OTP flow token not bound to the correct subject enabled a zero‑click account takeover.