API1:2023Sources & References
evlbot.xyz
← Back to lesson
References
Sources for API1 — Broken Object Level Authorization
Primary Source
OWASP API Security Top 10 — 2023
OWASP Foundation · owasp.org · 2023
The authoritative source for API security risks. API1:2023 Broken Object Level Authorization is the primary reference for the definition, attack scenarios, and mitigations in this module. This course is an independent study companion — not affiliated with or endorsed by OWASP.
Real Incidents
Peloton API Vulnerability — Unauthenticated User Data Exposure
TechCrunch · May 2021 · Reported by Jan Masters / Pen Test Partners
Security researcher Jan Masters discovered that Peloton's API returned private user data — age, weight, location, workout history — without requiring any authentication. 4+ million users affected. Peloton took ~3 months to fix after disclosure. Referenced in slides 1, 5, 11, 15, 26.
T-Mobile Data Breach — 37 Million Customer Records
T-Mobile SEC Disclosure · January 2023
T-Mobile disclosed that an attacker accessed a customer-facing API from approximately November 2022 through January 2023, exfiltrating 37 million customer records including names, addresses, emails, phone numbers, and account data. The breach ran undetected for ~6 weeks. Referenced in slides 5, 13, 26, 27.
Bumble API — User Location and Profile Exposure
Independent Security Research · Sanjana Sarda · 2020
Researcher Sanjana Sarda found that Bumble's API exposed precise GPS coordinates and full profile data for any user, including users who had blocked the requester. The API did not account for block relationships in its authorization logic. Referenced in slides 5, 15, 26.
USPS Informed Delivery — 60 Million Account Exposure
KrebsOnSecurity · November 2018
Any authenticated USPS.com user could access account details for any of the site's 60 million users by manipulating parameters in the Informed Delivery API. Name, address, email, phone number, and account data were exposed. Reported by Brian Krebs after being alerted by an independent researcher. Referenced in slides 5, 26.
Further Reading
OWASP Testing Guide — Testing for IDOR
OWASP Foundation · owasp.org
Detailed guidance on how to test for Insecure Direct Object Reference (IDOR) vulnerabilities — the older name for what OWASP now calls BOLA in the API context.
PortSwigger Web Security Academy — Access Control
PortSwigger · portswigger.net
Free interactive labs for practicing IDOR/BOLA exploitation in a safe environment. Excellent for hands-on learning after completing this module.
About this course: This is an independent, unofficial study companion built for educational purposes. Content is based on publicly available security research and the OWASP API Security Top 10 framework. This project is not affiliated with, endorsed by, or sponsored by the OWASP Foundation. All trademarks remain the property of their respective owners.