The newest API Security resources are on the API Security page. For a reading order instead of a date order, see the API Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-05-09 2026 | New ZiChatBot Malware Uses Zulip REST APIs as Command and Control Server news 3 min read | Library for detecting the ZiChatBot malware, which exploits Zulip REST APIs for command and control. This cross-platform malware, identified by Securelist and linked to the OceanLotus APT group (APT32), was distributed via malicious Python packages on PyPI, including fake libraries like uuid32-utils, colorinal, and termncolor. ZiChatBot uses two channel-topic pairs within Zulip to exfiltrate system information and receive shellcode commands, with execution confirmed by a heart emoji response. The dropper employs AES encryption and self-deletion for stealth. |
| 2026-05-07 2026 | Ollama vulnerability highlights danger of AI frameworks with unrestricted access news 2 min read | Library for running AI models on local hardware, Ollama, suffers from CVE-2026-7482, dubbed Bleeding Llama. This vulnerability, an out-of-bounds heap read in the model quantization pipeline, allows unauthenticated attackers to craft malicious GGUF files. Uploading these files via the API endpoint triggers a leak of sensitive process memory, including system prompts, user messages, environment variables, API keys, and proprietary code. Exploitation requires only three API requests to exfiltrate this data. Mitigation involves updating to Ollama version 0.17.1, using authentication proxies, and implementing IP access filters and firewalls. → csoonline.com |
| 2026-05-06 2026 | Major AI platform Ollama critically leaking: 300000 servers exposed to hackers news | Ollama, a popular AI platform, is critically vulnerable, exposing approximately 300,000 servers to potential hacking. This significant security lapse could allow unauthorized access to sensitive data and systems running on these servers. The extent of the breach and the specific nature of the leak are still under investigation, but the large number of affected servers highlights a major security concern within the AI infrastructure. Further details on remediation and the exact impact are expected as the situation develops. → cybernews.com |
| 2026-05-06 2026 | Palo Alto Networks PAN-OS flaw exploited for remote code execution news 1 min read RCE | Writeup of CVE-2026-0030, a critical PAN-OS buffer overflow vulnerability exploited for unauthenticated remote code execution with root privileges. The flaw primarily targets PA-Series and VM-Series firewalls where the User-ID Authentication Portal is exposed to the internet. Palo Alto Networks advises restricting access to trusted internal IP addresses to mitigate this risk, noting limited exploitation has been observed. Fixes are anticipated by May 13, 2026. → securityaffairs.com |
| 2026-05-06 2026 | Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution news 1 min read RCE | Writeup on CVE-2026-0300, a critical buffer overflow vulnerability in Palo Alto Networks' PAN-OS software, enabling unauthenticated remote code execution with root privileges. This flaw, exploitable via specially crafted packets and impacting specific versions of PAN-OS, has seen limited exploitation in the wild, primarily targeting publicly accessible User-ID Authentication Portals on PA-Series and VM-Series firewalls. Fixes are planned, with interim mitigation strategies including restricting or disabling the User-ID Authentication Portal. → thehackernews.com |
| 2026-05-06 2026 | n8n: From Parsing Bug to Remote Code Execution aka CVE-2026-42231 news 9 min read RCE | Writeup detailing CVE-2026-42231 in n8n, a node-based workflow automation tool. This vulnerability chain exploits a prototype pollution primitive within the xml2js XML parsing library, stemming from semantic quirks in its CoffeeScript origins. The research demonstrates how this seemingly low-severity bug, when combined with specific gadget chains in n8n's internal modules like `@n8n/node-cli`, can escalate to unauthenticated remote code execution, bypassing previous mitigations against `spawn` exploitation. |
| 2026-05-05 2026 | Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API news 1 min read RCE | Writeup of CVE-2026-22679, a critical unauthenticated RCE in Weaver E-cology 10.0, actively exploited via its debug API. Attackers can craft POST requests to "/papi/esearch/data/devops/dubboApi/debug/method" to execute arbitrary commands. Exploitation evidence dates back to March 17, 2026, with observed techniques including payload drops and discovery commands like `whoami`. A Python detection script is available to identify vulnerable instances. → thehackernews.com |
| 2026-04-28 2026 | ClickUp is leaking customer data via hardcoded API key researcher claims news Secrets | A security researcher claims that ClickUp is leaking customer data due to a hardcoded API key. This vulnerability could potentially expose sensitive information belonging to ClickUp users. → cybernews.com |
| 2026-04-23 2026 | wapiti-scanner/wapiti: Web vulnerability scanner written in Python3 beginner 5 min read Python | Library for black-box web vulnerability scanning. Wapiti works by fuzzing web applications, sending payloads, and analyzing responses for vulnerabilities such as SQL Injection, XSS, File Disclosure, XXE, CRLF Injection, Shellshock, SSRF, Open Redirects, and Log4Shell (CVE-2021-44228) and Spring4Shell (CVE-2020-5398) detection. It supports proxy configuration, HTTP authentication, session management, and generates reports in HTML, XML, JSON, TXT, and CSV formats. The library can also fingerprint web technologies using Wappalyzer and enumerate CMS modules for platforms like WordPress. |
| 2026-04-23 2026 | Microsoft issues out-of-band patch for critical security flaw in update to ASP.NET Core news 3 min read | Library update CVE-2026-40372 introduces a critical flaw in ASP.NET Core's Data Protection Library on Linux, macOS, and Windows. A bug in the .NET 10.0.6 package causes incorrect HMAC validation, allowing attackers to forge payloads and decrypt protected tokens and cookies. This requires rebuilding embedded applications, expiring affected tokens, and rotating credentials. → csoonline.com |
| 2026-04-22 2026 | Microsoft releases emergency patches for critical ASP.NET flaw news 2 min read | Library updates address critical ASP.NET Core privilege escalation vulnerability (CVE-2026-40372) in Data Protection cryptographic APIs. This flaw allows unauthenticated attackers to forge authentication cookies, potentially gaining SYSTEM privileges, disclosing files, and modifying data. The regression impacts Microsoft.AspNetCore.DataProtection NuGet packages from 10.0.0-10.0.6. Updates to 10.0.7 are recommended, followed by key ring rotation for full remediation. Previously, Microsoft patched an HTTP request smuggling bug (CVE-2025-55315) in the Kestrel web server. → bleepingcomputer.com |
| 2026-04-22 2026 | A Deep Dive on the Most Critical API Vulnerability: BOLA intermediate | A Deep Dive on the Most Critical API Vulnerability: BOLA |
| 2026-04-22 2026 | What Is Broken Object Property Level Authorization? beginner 14 min read | Guide to Broken Object Property Level Authorization, ranked third on OWASP's API Security Top 10 for 2023, details how APIs often fail to restrict access to individual data fields within objects. It covers how this vulnerability manifests in REST and GraphQL APIs, its business impact, and methods for implementing granular property-level access controls to prevent unauthorized reading and modification of sensitive data like internal identifiers or account status. → paloaltonetworks.com |
| 2026-04-22 2026 | What Is Broken Object Level Authorization? beginner 16 min read | Reference detailing Broken Object Level Authorization (BOLA), the top API security risk according to OWASP. This vulnerability arises when APIs fail to properly validate object permissions after function-level access is granted, allowing attackers to manipulate object identifiers within requests, such as direct object references in RESTful APIs, to access unauthorized data. The resource contrasts BOLA with Broken Function Level Authorization (BFLA), emphasizing that BOLA exploits parameter manipulation within authorized endpoints, not privilege escalation. → paloaltonetworks.com |
| 2026-04-22 2026 | This Is How I Hacked an API Using Mass Assignment Vulnerability intermediate 3 min read | Writeup detailing a silent privilege escalation via mass assignment in a REST API. The author demonstrates how trusting client-supplied JSON in profile update endpoints, where the backend blindly maps request fields to models without an allowlist, can lead to attackers silently gaining administrative privileges. This is achieved by "over-posting" extra fields like "role" or boolean flags, such as "is_admin", which the API then updates, effectively bypassing authorization. The writeup highlights common locations for this vulnerability, including profile updates, registration, and admin edit endpoints, and stresses the importance of explicit field allowlisting and using separate DTOs to prevent such flaws. |
| 2026-04-22 2026 | CVE-2026-34839: CORS Vulnerability in Glances REST API news | CVE-2026-34839: CORS Vulnerability in Glances REST API |
| 2026-04-22 2026 | API ThreatStats Report 2026 news | API ThreatStats Report 2026 |
| 2026-04-22 2026 | VAmPI: Vulnerable REST API with OWASP Top 10 Vulnerabilities beginner 3 min read | Library implementing OWASP Top 10 API vulnerabilities, including SQLi, unauthorized password change, broken object level authorization, mass assignment, excessive data exposure, user and password enumeration, RegexDOS, lack of resources and rate limiting, and JWT authentication bypass. VAmPI is built with Flask, offers a global switch to enable or disable vulnerabilities, and includes OpenAPI 3 specs and a Postman collection for testing and learning purposes. It can be run locally via Python or Docker. |
| 2026-04-22 2026 | API4:2023 Unrestricted Resource Consumption beginner | API4:2023 Unrestricted Resource Consumption |
| 2026-04-22 2026 | 1H 2026 State of AI and API Security Report (Salt) news | 1H 2026 State of AI and API Security Report (Salt) |
| 2026-04-22 2026 | PortSwigger Lab: Exploiting a Mass Assignment Vulnerability intermediate 1 min read | Lab walkthrough demonstrating exploitation of a mass assignment vulnerability to purchase a product. The lab involves logging in with `wiener:peter`, adding an item to the basket, and then identifying and manipulating a `chosen_discount` parameter within the `/api/checkout` POST request. By adding this hidden parameter and altering its value, users can bypass credit limitations and solve the exercise. → portswigger.net |
| 2026-04-21 2026 | Vibe coding upstart Lovable denies data leak cites 'intentional behavior' then throws HackerOne under the bus news 4 min read | Writeup detailing a Broken Object Level Authorization (BOLA) vulnerability exploited by an OSINT researcher against Vibe coding platform Lovable. The vulnerability allowed unauthorized access to sensitive user data, including credentials, chat history, and source code, via publicly accessible projects. Lovable's initial response attributed the exposure to "intentional behavior" and unclear documentation before blaming bug bounty platform HackerOne for mishandling the researcher's report. → theregister.com |
| 2026-04-21 2026 | Lovables API flaw exposed private project data from the $6.6 billion AI app builder used by Nvidia and Microsoft teams news 3 min read | Analysis of a Lovable API vulnerability that exposed chat histories, source code, and Supabase API keys from projects created before November 2025. The flaw, reported via HackerOne in March 2026, stemmed from missing ownership checks on API endpoints, allowing any authenticated user to access data from older projects, impacting users at companies like Nvidia and Microsoft. Affected users are advised to rotate all credentials used within the platform. → startupfortune.com |
| 2026-04-21 2026 | Lovable Left Thousands of Projects Exposed for 48 Days And Still Hasn't Fixed It news 4 min read | Writeup of BOLA vulnerability in Lovable.dev API exposing source code, database credentials, and AI chat histories. The flaw, affecting projects created before November 2025, allows free account users to access sensitive data from other users. This vulnerability, reported on HackerOne, highlights systemic security issues in AI-assisted development platforms, similar to the recent Vercel incident linked to Context.ai. Lovable has addressed chat history exposure but maintains source code visibility on public projects is intentional. |
| 2026-04-21 2026 | API Security Risks Rise as AI Adoption Accelerates beginner 4 min read | Survey of API security risks stemming from AI adoption, revealing that 49% of organizations struggle to monitor machine-to-machine traffic and 48% cannot distinguish AI agents from bots. The report highlights amplified vulnerabilities like broken object-level authorization (BOLA) and challenges with AI-generated code security, noting traditional SAST and DAST tools are insufficient. Attackers increasingly target authenticated access, with 99% of attempts originating from such entities, underscoring the need for continuous verification and behavioral monitoring. → esecurityplanet.com |
| 2026-04-19 2026 | BOLA API Attack & Prevention — StackHawk intermediate 13 min read AuthZ | Library detailing Broken Object Level Authorization (BOLA) vulnerabilities, the #1 API security risk. BOLA occurs when APIs fail to verify user permissions for specific data objects, allowing unauthorized access to sensitive information like financial or medical records by manipulating predictable identifiers or bypassing ownership checks. The resource explains BOLA's prevalence, the distinction from IDOR, root causes like over-reliance on object identifiers and insufficient authorization focus, and provides examples of attacks against social media profiles and medical records. |
| 2026-04-19 2026 | Broken Object-Level Authorization (BOLA): What It Is and How to Prevent It beginner 6 min read | Reference explaining Broken Object-Level Authorization (BOLA), the most common API vulnerability, where unchecked object identifiers expose sensitive data. It details how attackers exploit BOLA by manipulating identifiers, the risks in microservices, and secure coding practices involving server-side authorization checks on every request. The article highlights compliance implications under GDPR and HIPAA, and prevention strategies including robust authorization logic, opaque identifiers, and automated API security testing to detect variants like insecure direct object references (IDOR). → invicti.com |
| 2026-04-19 2026 | OWASP Top 10 API Security Risks and How to Mitigate Them — Pynt beginner 11 min read | Library of techniques and examples for mitigating the OWASP API Security Top 10 risks, including Broken Object Level Authorization (BOLA), Broken Authentication, and Server-Side Request Forgery (SSRF). It details practical defenses like fine-grained authorization, secure authentication protocols, and rate limiting. The resource also highlights how tools can automate detection of these vulnerabilities during development, addressing common weaknesses such as misconfigurations and improper inventory management. |
| 2026-04-16 2026 | MCP Access Control: OPA vs Cedar - Natoma advanced 4 min read | Reference comparing Open Policy Agent (OPA) and AWS Cedar for MCP access control. Independent research indicates Cedar offers stronger security guarantees, deterministic behavior, and formal verification, excelling in safety-critical or AWS-centric environments with simpler policies. OPA, with its Rego language, provides greater expressiveness and integration capabilities, making it suitable for complex logic and mature operational scenarios. The choice depends on prioritizing security and performance (Cedar) versus flexibility and extensive integrations (OPA). |
| 2026-04-16 2026 | Inside Modern API Attacks: 2026 API ThreatStats Report - Wallarm news 6 min read | Report analyzing 2025 API attack trends from Wallarm's 2026 API ThreatStats Report, highlighting APIs as the primary attack surface due to compounding failures in identity, exposure, and abuse. It details that 43% of CISA KEVs and 36% of AI vulnerabilities are API-related. Attack vectors like Cross-Site Issues, Injection, and Broken Access Control are prevalent, with 97% of vulnerabilities exploitable by a single request and 98% being easy or trivial to exploit. |
| 2026-04-16 2026 | OWASP API Security Testing Framework beginner 2 min read | Library for automated API security validation, the OWASP API Security Testing Framework (ASTF) identifies vulnerabilities based on the OWASP API Security Top 10. It supports REST, GraphQL, and gRPC, offers a comprehensive test suite, CI/CD integration, customizable rules, and detailed reporting with remediation guidance, incorporating real-world attack patterns. → owasp.org |
| 2026-04-16 2026 | Kong API Gateway Misconfigurations Case Study - Trend Micro news 10 min read | Library for securing Kong API Gateway deployments, detailing common misconfigurations such as exposing the administration API and missing firewall rules. It highlights the risk of storing secrets like API keys in plain text within the database, especially in the community version lacking robust encryption and vault support. The entry emphasizes the importance of secure access controls and proper network segmentation to prevent unauthorized access and potential back-end compromise. → trendmicro.com |
| 2026-04-16 2026 | API Security Testing: Tools and Techniques - API7.ai beginner 7 min read | Library for comprehensive API security testing, detailing static analysis with tools like Semgrep and Gosec, dynamic testing using OWASP ZAP and StackHawk, and penetration testing with Burp Suite. It emphasizes business logic testing for BOLA and IDOR vulnerabilities, highlighting specialized tools such as Escape and Cequence. The resource also covers AI-powered protection, API gateway enforcement, and open-source developer tools, stressing discovery and inventory mapping with Akto and Noname. |
| 2026-04-16 2026 | BOLA and BFLA: The API Vulnerabilities That Silently Expose Data beginner 5 min read | Library for identifying and mitigating Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA) vulnerabilities in APIs. These OWASP API Security Top 10 risks, often missed by automated scanners, allow unauthorized access to user data or administrative functions by failing to enforce object ownership and role-based access controls server-side. The library's approach mirrors penetration testing methodologies, emphasizing multi-account testing and endpoint function enumeration to uncover these critical business-logic flaws. |
| 2026-04-16 2026 | API Penetration Testing: Complete Guide beginner 18 min read | Reference covering API penetration testing methodology, focusing on techniques to identify and exploit vulnerabilities in programmatic interfaces. It details threats from the OWASP API Security Top 10, including Broken Object Level Authorization (BOLA), Broken Authentication, and Server Side Request Forgery (SSRF). The guide also discusses security differences and testing approaches for REST, GraphQL, and gRPC architectures. |
| 2026-04-16 2026 | Securing the Gates: Mastering BOLA and BFLA in API Security intermediate 6 min read | Writeup detailing Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA) vulnerabilities in API security. The resource demonstrates how BOLA allows unauthorized access to sensitive data by exploiting improper authorization checks on specific objects, using OWASP crAPI and Firefox Containers to illustrate intercepting and altering requests. It then explores BFLA, where users can execute functions beyond their permitted scope, showcasing how changing endpoint parameters from "user" to "admin" can lead to unauthorized actions like deleting other users' videos. |
| 2026-04-11 2026 | Exploiting Server-Side Request Forgery in an API intermediate 9 min read | Library for identifying and exploiting Server-Side Request Forgery (SSRF) vulnerabilities in APIs. This resource details how SSRF, a dangerous OWASP API Security Top 10 vulnerability, allows attackers to trick servers into making unauthorized requests, potentially leading to data leaks or remote code execution. It covers techniques for identifying SSRF through common parameter names, webhooks, file imports, and PDF generators, and explores exploitation methods like local/remote port scanning and local file reads. → danaepp.com |
| 2026-04-11 2026 | API Versioning Vulnerabilities: Deprecated Endpoints Still Accepting Requests intermediate | API Versioning Vulnerabilities: Deprecated Endpoints Still Accepting Requests |
| 2026-04-11 2026 | Exploiting JWT Vulnerabilities: Advanced Exploitation Guide advanced 11 min read Bug Bounty JWT | Library detailing advanced JWT exploitation techniques, covering flaws stemming from misconfigurations and improper input validation. It analyzes vulnerabilities such as the 'none' algorithm allowance, missing signature validation, algorithm confusion attacks, and JWK spoofing, referencing CVE-2018-0114. The guide breaks down JWT structure and common attack vectors like authentication bypass and injection. → intigriti.com |
| 2026-04-11 2026 | openapi-fuzzer: Black-box Fuzzer for OpenAPI Specifications intermediate 4 min read | Tool for black-box fuzzing APIs based on OpenAPI specifications (v3). This Rust-based fuzzer, `openapi-fuzzer`, identifies parsing bugs and invalid formats by generating and sending payloads. It stores findings in JSON and can replay triggering seeds using the `resend` subcommand. Configuration options include ignoring specific status codes, adding custom headers, and adjusting request counts. |
| 2026-04-11 2026 | CATS: REST API Fuzzer and Negative Testing Tool intermediate | Library for REST API negative testing, CATS automatically generates and runs thousands of tests based on data types and structural constraints, moving beyond typical random input fuzzing. It offers rapid execution with no coding required and extensive configurability, allowing users to match or ignore response codes, bodies, API paths, and more, while fine-tuning reporting. |
| 2026-04-11 2026 | RESTler: Stateful REST API Fuzzing Tool intermediate 5 min read | Library for stateful REST API fuzzing that analyzes OpenAPI specifications to generate and execute tests, discovering security and reliability bugs. RESTler intelligently infers producer-consumer dependencies and dynamically learns service behavior from responses to explore deeper service states and find issues like internal server errors and logic bugs. It offers compile, test, fuzz-lean, and fuzz modes for comprehensive bug hunting. |
| 2026-04-11 2026 | BFLA: Broken Function Level Authorization beginner 4 min read | Library: BFLA is a resource that delves into Broken Function Level Authorization vulnerabilities. This document, crafted by TCM Security, is part of their broader offerings in cybersecurity services and education, including penetration testing, vulnerability scanning, and training. The content implicitly supports their mission of revealing risk, meeting requirements, and strengthening security for organizations by exposing exploitable gaps. |
| 2026-04-11 2026 | API Gateway Authorizers: Vulnerable By Design intermediate 5 min read | Library discussing how API Gateway authorizer caching can lead to authorization vulnerabilities. When caching is keyed solely by the JWT, subsequent requests to different resources can incorrectly inherit permissions from previous requests. This is especially problematic when using services like AWS Verified Permissions to grant granular access, as the cache may not reflect specific resource authorizations, leading to potential over-permissioning. The solution involves configuring the API Gateway cache key to include the HTTP method and path, ensuring that authorization checks are specific to the requested resource. |
| 2026-04-11 2026 | HTTP Request Smuggling in API Gateways intermediate 6 min read | Library for detecting and preventing HTTP request smuggling attacks targeting API gateways. This technique exploits discrepancies in how gateways and backends interpret request boundaries, allowing attackers to bypass security controls like authentication and rate limiting. The library details common attack types such as CL.TE, TE.CL, and H2.CL, and provides mitigation strategies like enforcing HTTP/2 end-to-end, disabling backend connection reuse, and normalizing ambiguous requests. It also references specific vulnerabilities like CVE-2024-53008 and CVE-2023-40225 affecting HAProxy, and CVE-2024-33452 impacting Kong Gateway. |
| 2026-04-11 2026 | Kong API Gateway Misconfigurations: A Security Case Study intermediate 10 min read | Library detailing Kong API Gateway misconfigurations, including exposing the Administration API on public interfaces, missing firewall rules, and insecure storage of secrets like API keys in plain text. It highlights how default configurations and examples found in container image repositories can lead to these vulnerabilities, emphasizing the need for proper access controls and secure credential management. → trendmicro.com |
| 2026-04-11 2026 | Swagger-EZ: Pentesting APIs Using OpenAPI Definitions intermediate | Tool for pentesting APIs using OpenAPI (Swagger) definitions. Swagger-EZ parses Swagger 2.0 JSON files, either by URL or pasted blob, to populate API endpoints and parameters within a browser UI. Users configure their proxy, like Burp Suite, to intercept requests. After loading the API definition, parameters can be populated with test data and sent, facilitating API security testing. |
| 2026-04-11 2026 | APIDetector: Scan for Exposed Swagger Endpoints intermediate 7 min read | Library for scanning exposed Swagger and OpenAPI endpoints. APIDetector v3 features a modern web interface and command-line options for discovering API documentation like `/swagger-ui.html` and `/openapi.json`. It supports multi-threaded scanning over HTTP/HTTPS, automatically captures screenshots of vulnerable endpoints, and performs XSS detection on vulnerable Swagger versions. The tool is built with Python 3.x and requires Flask, Requests, and Playwright for browser automation. |
| 2026-04-11 2026 | Autoswagger: Automated Discovery and Testing of OpenAPI and Swagger Endpoints intermediate 5 min read | Tool for automated discovery and testing of OpenAPI and Swagger endpoints, Autoswagger identifies unauthenticated API endpoints and data exposure risks. It locates spec files, extracts paths and methods, and concurrently tests endpoints, flagging outputs containing personally identifiable information or secrets using Presidio and regex heuristics. The tool supports multi-phase discovery, optional brute-force parameter testing, and flexible JSON or table output for actionable results. |
| 2026-04-11 2026 | Swagger Jacker: Auditing OpenAPI Definition Files intermediate 3 min read | Tool for auditing OpenAPI definition files. Swagger Jacker automates the analysis of API routes defined in specification documents, identifying potential vulnerabilities like IDOR and SQL injection. It parses fields such as "Info" for API metadata and "security" for authentication mechanisms, then generates requests to test endpoint accessibility and authentication requirements, significantly reducing manual testing time for publicly exposed or unintentionally leaked definition files. → bishopfox.com |