Tag

Posts tagged ‘api-security’

2 cases tagged with ‘api-security’

Mar 22, 20265 min read

Half a Billion Profiles Behind a User-Agent String

A major platform's API returned full user profiles to anyone who asked. The only barrier was a WAF that ignored mobile traffic. One header change, hundreds of millions of accounts exposed.

Read case

Auth BypassCVSS 8.6high

Mar 20, 20265 min read

The Trailing Slash That Bypassed Authentication

Adding a single character to the end of a URL turned a 401 into a 200. Not on one endpoint — on thirty, across ten microservices. One slash, an entire backend unlocked.

Read case

Back to all cases