API2:2023 — Broken Authentication

Slide 8 · Why It's #2

Account takeover is the master key.

Every other risk assumes authentication worked. This one breaks that assumption.

The Threat Model

All of the other API risks — BOLA, mass assignment, rate limit abuse — assume the attacker is an authenticated user doing something they shouldn't. They assume the API knows who it's talking to.

Broken authentication removes that assumption entirely. The attacker isn't a user doing something wrong — they're pretending to be a different user entirely. And the API can't tell the difference.

With broken auth

Attacker picks any victim account

Bypasses, steals, or forges their token

API thinks it's the victim

All of the victim's data and actions are available

Authorization, rate limits, audit logs — all point to the victim

Why it's ranked #2 (not #1)

BOLA is more prevalent — easier to introduce accidentally

Broken auth is usually harder to exploit at scale

But when it works, the blast radius is total

Credential stuffing scaled to millions — that's automation at full blast

← Back Show me how it's done →