I went to look at the password change endpoint on my own site and realized it never confirmed the requester actually owned the account. No crash, no error — just quiet, full account takeover. A walkthrough of a textbook Broken Access Control bug and the checks that fix it.
Web Development
One Missing Check: The Password Endpoint That Never Asked Who You Were
1 post
All topics ›No posts in this topic match your search.