Pentesting
Seven API vulnerabilities we still find in almost every test
Broken object-level authorization tops the list again. A practical walkthrough of the flaws our testers exploit most, and how to fix them in code.
SAMO Offensive Team · · 11 min read
APIs are now the primary attack surface of most modern products. Automated scanners catch the obvious issues, but the flaws that lead to real breaches are usually logical, and they require a human to find.
The recurring seven
- Broken object-level authorization (IDOR) on resource identifiers
- Mass assignment of privileged fields such as role or tenant_id
- JWT validation weaknesses, including algorithm confusion
- Missing rate limiting on authentication and OTP endpoints
- Excessive data exposure in list endpoints
- Server-side request forgery through webhook and import features
- Inconsistent authorization between REST and GraphQL layers
Fix it at the framework level
The most durable fixes are structural: a single authorization middleware that every route passes through, explicit allow-lists for writable fields, and contract tests that assert one tenant can never read another tenant's objects.