Slide 2 · Definition
Security Misconfiguration — the right feature, the wrong settings.
Not a code bug. Not a logic flaw. The code works as intended — but the intent was wrong.
One-sentence definition
Security Misconfiguration occurs when an API or its supporting infrastructure is deployed with insecure default settings, missing hardening, unnecessary features enabled, or improperly configured access controls — creating exploitable security gaps that no amount of correct application code can fix.
BOLA — code doesn’t check ownership
Broken Auth — code implements authentication incorrectly
BFLA — code doesn’t check function permissions
SSRF — code trusts user-supplied URLs
Each of these: fix the code and the risk is gone
CORS — the HTTP header is set incorrectly
Error messages — the debug mode is left on in production
Open admin — the dashboard is deployed without auth
Weak TLS — the server accepts deprecated protocol versions
Each of these: fix the configuration and the risk is gone. No code change needed.
Why “misconfiguration” is a category, not a single vulnerability
API8 is the broadest OWASP API risk. It covers everything from a single missing HTTP header to an entire admin console left open on the internet. The common thread: a security control exists, is available, and is not applied — or is applied incorrectly. The vulnerability is in the deployment, not the software.