Applications
API Security Flaws
APIs expose business logic directly — and are routinely deployed with weaker security than web UIs.
What it is
The OWASP API Security Top 10 identifies the most exploited API vulnerabilities: Broken Object Level Authorization (BOLA/IDOR), broken authentication, excessive data exposure, and lack of rate limiting. APIs are frequently deployed with implicit trust assumptions that do not hold when consumed by third parties or mobile clients. Undocumented and shadow APIs accumulate as products evolve.
Attack techniques
- BOLA — Broken Object Level Authorization
- Broken Function Level Authorization
- Mass Assignment
- Excessive Data Exposure
- Lack of Rate Limiting
- Unauthenticated API endpoints
Business impact
API vulnerabilities are responsible for significant data breaches. BOLA alone accounts for a majority of API-related incidents — a single parameter change in a request returns another user's complete record.