API security

Everything TechSec Headlines has reported about API security: 2 stories, newest first. Part of our Vulnerabilities coverage.

17 Oct
Vulnerabilities

Webreaper Damselfly 4.5.3 Authentication Removal Enables Unchecked API Admin Account Creation

Commented-out code in Webreaper Damselfly 4.5.3 removes authentication checks, allowing unauthenticated users to create admin accounts and reset passwords.

16 Oct
Vulnerabilities

Broken Object Level Authorization: How to Fix API Logic Errors

BOLA exploits occur when an API trusts client-side IDs without verifying the user owns the resource, allowing attackers to access data they should not see.