Another day of discovering insecure APIs.
The NTSA instant fine speed camera system uses OTP to access fine details. However, the captured images appear to be hosted on AWS with no authentication.
That alone might be acceptable for static images, but the issue is that the file path follows a predictable pattern. By changing the index in the URL, other images can be accessed.
This becomes a basic access control problem that should be addressed.
Example image from the system below (vehicle and identifiers blurred). The concern is that these images appear publicly accessible through predictable URLs.