The newest Authorization / Broken Access Control resources are on the Authorization / Broken Access Control page. For a reading order instead of a date order, see the Authorization / Broken Access Control learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | BOLA Vulnerability - Vulnsy beginner 5 min read | Writeup on Broken Object Level Authorization (BOLA), the top OWASP API Security Top 10 risk, detailing how attackers exploit API endpoints that expose object identifiers without proper authorization checks. It covers BOLA's impact on unauthorized data access and modification, simple exploitation methods, and advanced techniques like using predictable IDs or GraphQL introspection. Remediation steps include implementing centralized authorization, using UUIDs, and robust testing with tools like Burp Suite and OWASP ZAP. |
| 2026-04-10 2026 | BOLA: API Attack & Prevention - StackHawk intermediate 13 min read API Sec | Library detailing Broken Object Level Authorization (BOLA), the OWASP API Security Top 10's persistent #1 risk. BOLA vulnerabilities, also known as Insecure Direct Object Reference (IDOR), occur when APIs fail to verify user permissions for specific data objects, allowing attackers to access or modify sensitive information like financial or medical records by altering predictable identifiers in API requests. The article explains BOLA's root causes, including over-reliance on object identifiers, lack of ownership verification, and insufficient authorization focus, alongside practical examples and prevention strategies. |
| 2026-04-10 2026 | What is BOLA - Imperva beginner 6 min read | Guide to Broken Object Level Authorization (BOLA), a top OWASP API security risk. BOLA occurs when applications fail to verify user authorization for specific data objects, allowing access to sensitive information or unauthorized actions. The guide details how attackers identify vulnerabilities by manipulating object references, such as sequential IDs in URLs or GraphQL mutations, leading to data breaches and compliance failures under regulations like GDPR and HIPAA. Prevention strategies include applying proper access controls, mapping users to accessible objects, implementing robust authentication, using non-guessable IDs, and leveraging API gateways. → imperva.com |
| 2026-04-06 2026 | 2026 SANS Identity Threats Report: Why Attacks Still Work news 5 min read | Report summarizing the 2026 SANS Identity Threats & Defenses Survey, revealing that while identity security solutions are widely deployed, identity-related breaches persist due to a mismatch between defenses and attack methods. The survey highlights challenges in containment post-detection and the increasing reliance on legitimate credentials obtained via compromised browsers, MFA fatigue, and token-based access, emphasizing that credential exposure upstream of authentication is the root cause of ongoing attacks, not authentication failures themselves. |
| 2026-04-06 2026 | Exposing Security Blind Spots in GCP Vertex AI advanced 11 min read | Writeup on double agents in GCP Vertex AI, detailing how a misconfigured Per-Project, Per-Product Service Agent (P4SA) with excessive default permissions can be exploited. This research demonstrates obtaining privileged access to consumer project data and restricted Google-owned Artifact Registry repositories, including proprietary container images for the Vertex AI Reasoning Engine, by compromising a single service agent and exfiltrating its credentials. → unit42.paloaltonetworks.com |
| 2026-04-06 2026 | Critical Access Control Risks in Simple Membership CVE-2026-34886 news 10 min read | Advisory detailing CVE-2026-34886, a critical broken access control vulnerability in WordPress Simple Membership plugin versions 4.7.1 and earlier. This flaw allows unauthenticated users to execute privileged actions, potentially leading to unauthorized access, data manipulation, or site compromise. Immediate remediation involves updating to version 4.7.2 or higher, with temporary workarounds including plugin disabling, server-level blocking of PHP execution, or WAF virtual patching. Developer recommendations focus on implementing robust capability checking, nonce verification, and REST API permission callbacks. |
| 2026-04-06 2026 | Security Update: Vulnerability Disclosures and Ongoing Hardening - LiteLLM news 2 min read | Library updates address critical and high-severity vulnerabilities in LiteLLM, including authentication bypass via OIDC cache collision (CVE-2026-35030), privilege escalation through /config/update (CVE-2026-35029), and password hash exposure with pass-the-hash login (GHSA-69x8-hrgq-fjj8). These fixes, along with an ongoing audit by Veria Labs and a new bug bounty program, enhance the security posture of the proxy. |
| 2026-04-03 2026 | Broken Authentication and IDOR – A Big but Solvable Problem | Inspectiv beginner 5 min read | Reference detailing common application security vulnerabilities, specifically Broken Authentication and Insecure Direct Object Reference (IDOR). It highlights attack vectors like credential stuffing, brute force, and session hijacking, alongside IDOR exploits through predictable identifiers. Mitigation strategies discussed include Multi-Factor Authentication (MFA), server-side validation, least privilege access controls, and using non-sequential identifiers. The resource emphasizes the importance of continuous external validation through bug bounty programs and dynamic application security testing to detect these prevalent threats. |
| 2026-04-03 2026 | Exploiting Broken Access Control Vulnerability for Bounty intermediate | Exploiting Broken Access Control Vulnerability for Bounty |
| 2026-04-03 2026 | Broken Access Control Testing Software for Web Apps | Penti AI intermediate 1 min read | Tool for autonomous broken access control vulnerability testing; Penti's AI agents discover, reproduce, and prioritize exploitation paths like insecure direct object references and weak tenancy boundaries, then human experts verify impact. The platform offers clear evidence and developer-ready remediation for authorization checks, object scoping, and tenancy isolation, integrating into the SDLC to test for horizontal and vertical privilege escalation. |
| 2026-04-03 2026 | WSTG Methodology: Web Penetration Testing | Haxoris beginner 4 min read | Guide detailing the OWASP Web Security Testing Guide (WSTG) methodology for comprehensive web application penetration testing. It covers information gathering, configuration, authentication, session management, authorization, input validation (including XSS and SQL Injection), cryptography, and business logic flaws, aiming to uncover threats like IDOR and SSRF. The guide emphasizes a systematic approach, using tools like Burp Suite, and provides detailed reports with remediation steps and a free retest. |
| 2026-04-03 2026 | Insecure Direct Object Reference (IDOR) Attack Guide | Hackviser beginner 7 min read IDOR | Guide to Insecure Direct Object Reference (IDOR) vulnerabilities, detailing manual testing techniques across URL parameters, POST bodies, HTTP headers, cookies, and file access. It covers automated discovery using tools like Burp Suite and ffuf, scripting with Python, and various attack vectors including numeric, UUID, hash-based, parameter pollution, and mass assignment bypasses, as well as blind IDOR exploitation. |
| 2026-04-03 2026 | OWASP Top 10 #1: Broken Access Control and Security Tips beginner 9 min read | Guide analyzing OWASP Top 10 #1, Broken Access Control. It details common exploit scenarios, including Insecure Direct Object References (IDOR) and Mass Assignment vulnerabilities. The guide provides practical advice and fixes for strengthening access control, differentiating between vertical, horizontal, and contextual controls, and explaining how authentication and session management contribute to overall security. → vaadata.com |
| 2026-04-03 2026 | Primer on Broken Access Control Vulnerabilities and How to Find Them beginner 11 min read | Writeup on broken access control vulnerabilities, which have become the top OWASP Top 10 vulnerability. It details vertical and horizontal privilege escalation, including techniques like insecure direct object references (IDOR), lack of protection over sensitive functionality (e.g., direct URL access to admin pages), inadequate parameter-based access control (e.g., manipulating `admin=true` parameters), and misconfigured platform-level controls that can be bypassed with custom HTTP headers or alternative HTTP methods. |
| 2026-04-03 2026 | Horizontal and Vertical Privilege Escalation Explained | Blue Goat Cyber beginner 3 min read | Reference detailing medical device cybersecurity requirements, focusing on FDA submissions, SPDF development, SBOMs, and threat modeling. It emphasizes the importance of understanding device operation, real-world threats, and supply chain risks, referencing standards like ISO 14971, FDA Guidance, UL 2900, and AAMI TIR57 to ensure compliance and patient safety. |
| 2026-04-03 2026 | Broken Access Control - Vertical Privilege Escalation Writeup intermediate 8 min read | Writeup detailing the identification and exploitation of Broken Access Control vulnerabilities, specifically focusing on Vertical Privilege Escalation. It provides a walkthrough of PortSwigger labs, demonstrating techniques such as discovering admin URLs via robots.txt, source code analysis, manipulating cookie parameters to elevate privileges, and modifying request parameters like `roleid` using Burp Suite to gain administrative access and delete users. |
| 2026-04-03 2026 | Access Control Vulnerabilities and Privilege Escalation | PortSwigger beginner 9 min read | Reference detailing access control vulnerabilities and privilege escalation, explaining vertical and horizontal controls, context-dependent mechanisms, and common vulnerabilities such as unprotected functionality, parameter-based bypasses, and platform misconfigurations involving headers like `X-Original-URL` and `X-Rewrite-URL`. It also covers URL-matching discrepancies, including case insensitivity and the `useSuffixPatternMatch` option in Spring. → portswigger.net |
| 2026-04-03 2026 | Insecure Direct Object References (IDOR) | PortSwigger beginner 2 min read IDOR | Reference on Insecure Direct Object References (IDOR), an OWASP Top Ten vulnerability type where applications misuse user-supplied input to access objects directly. It details how attackers can exploit this, leading to horizontal or vertical privilege escalation by altering parameters to access other users' data, such as in database queries (e.g., `customer_account?customer_number=132355`) or static files (e.g., `/static/12144.txt`). → portswigger.net |
| 2026-04-03 2026 | IDOR - HackTricks beginner 6 min read | Reference detailing Insecure Direct Object Reference (IDOR) and Broken Object Level Authorization (BOLA) vulnerabilities, which occur when applications expose user-controllable identifiers to access internal objects without proper authorization checks. The resource highlights exploitation techniques using parameters in paths, queries, JSON bodies, headers, and cookies, including examples with sequential IDs and common tools like `curl` and `ffuf`. It discusses real-world breaches such as the McHire applicant data exposure and the Carlsberg media leak, emphasizing that encoding does not inherently provide security and advocating for server-side object-level authorization and unpredictable identifiers like UUIDv4. → book.hacktricks.xyz |
| 2026-04-03 2026 | Testing for Privilege Escalation | OWASP WSTG intermediate 5 min read | Guide detailing privilege escalation testing within the OWASP Web Security Testing Guide. It covers techniques for identifying and exploiting vulnerabilities that allow users to gain unauthorized access to more resources or functionality. Specific methods include manipulation of user groups, profiles, condition values, and IP addresses, as well as bypassing authorization schemas by switching session identifiers. The guide also provides examples of how to test for vertical and horizontal privilege escalation. → owasp.org |
| 2026-04-03 2026 | Testing for Insecure Direct Object References | OWASP WSTG beginner 4 min read | Guide for testing Insecure Direct Object References (IDOR), a vulnerability where direct object access is granted based on user-supplied input. It details how attackers can bypass authorization by modifying parameters used to retrieve database records, perform operations, access file system resources, or invoke application functionality. The guide recommends mapping object reference points, assessing access controls, and using multiple test user accounts with different object ownership and privileges to identify and exploit IDOR flaws. → owasp.org |
| 2026-04-03 2026 | Broken Authentication: Advanced Exploitation Guide | Intigriti advanced 9 min read | Guide to exploiting broken authentication vulnerabilities, this resource covers identifying and exploiting common and advanced flaws. It details techniques like forced browsing, utilizing default credentials, and leveraging lack of rate limiting for brute-forcing. The guide also explains how input validation issues, such as SQL injection, can lead to authentication bypasses, providing examples for practical application. → intigriti.com |
| 2026-04-03 2026 | How To Find Broken Access Control Vulnerabilities in the Wild | HackerOne intermediate 7 min read | Guide to finding Broken Access Control (BAC) vulnerabilities, explaining concepts like Insecure Direct Object Reference (IDOR) and covering identifier types such as numeric, user-chosen, natural keys, composite keys, UUIDs, and hashes. It details the permissions mapping technique for identifying BAC flaws by creating lists of user roles and application actions, and highlights the prevalence of BAC bugs as the OWASP Top 1 vulnerability. → hackerone.com |
| 2026-04-03 2026 | BugQuest 2026: 31 Days of Broken Access Control | Intigriti intermediate 7 min read IDOR | Collection of 31 posts detailing broken access control (BAC) vulnerabilities, covering OWASP A01:2025 concepts, authentication versus authorization distinctions, and various authorization models like RBAC. It explores discovery techniques including content discovery with ffuf, JavaScript enumeration, API documentation mining, GraphQL introspection, and mobile application analysis. Specific exploitation methods discussed include request method tampering, HTTP parameter pollution, static keyword swapping, JWT algorithm confusion, and second-order attacks, alongside practical examples like IDOR and URL-matching discrepancies. → intigriti.com |
| 2026-04-03 2026 | Authn vs. authz: How are they different? beginner AuthN | Authentication (authn) refers to identity, while authorization (authz) has to do with permissions. Learn about the difference between authn vs. authz in more detail. |
| 2026-03-01 2026 | gadievron/raptor: Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations. advanced 7 min read AI | Library for autonomous security research, RAPTOR orchestrates static analysis, binary analysis, LLM-powered vulnerability validation, exploit generation, and patch writing. It integrates Semgrep and CodeQL for scanning and utilizes LLMs for vulnerability analysis, generating Proof-of-Concepts, and creating patches. RAPTOR supports multiple LLM providers and can leverage Z3 for constraint analysis to improve accuracy and prioritize reachable exploits. It offers project management features for organizing findings and tracking progress across multiple runs. |
| 2026-01-21 2026 | OAuth 2.0 Course for Beginners beginner AuthN | Course on OAuth 2.0 for beginners, explaining the authorization framework's use of access tokens for delegated access and passwordless integration with third-party apps. It covers key concepts like the four OAuth roles (Resource Owner, Client, Auth Server, Resource Server), the importance of PKCE, and practical implementation details for building authorization and resource servers, alongside client applications. The 2-hour video tutorial also addresses debugging common issues such as JWKS and Axios errors, concluding with a summary of best practices and repository setup. |
| 2025-10-22 2025 | Beyond credentials: weaponizing OAuth applications for persistent cloud access | Proofpoint US intermediate 7 min read AuthN | Tool for automating the creation of malicious second-party OAuth applications within compromised cloud environments. This tool, developed by Proofpoint researchers, demonstrates how threat actors can achieve persistent access, even after user credentials are reset or multi-factor authentication is enforced, by registering internal applications with chosen API scopes such as Mail.Read and offline_access. The research highlights a real-world attack vector already exploited by threat actors, offering a technical analysis of the automated process for application registration, secret generation, and token harvesting. |
| 2025-09-05 2025 | Authentication Explained: When to Use Basic, Bearer, OAuth2, JWT & SSO | daily.dev beginner AuthN JWT | Guide to authentication and authorization mechanisms, detailing the differences and use cases for Basic, Bearer, OAuth2, JWT, and SSO. It explains authorization models such as RBAC, ABAC, and ACL, highlighting how real-world applications like GitHub and Stripe combine them. The entry emphasizes selecting appropriate models and token types based on application complexity and security needs. |
| 2024-10-03 2024 | Automate your API hacking with Autorize intermediate 6 min read API Sec AuthN | Library that automates API security testing by detecting broken object level authorization (BOLA) and other access control issues. Autorize, a Burp Suite extension, functions by sending modified requests with low-privileged, high-privileged, and unauthenticated user tokens to APIs. It then analyzes responses for discrepancies, flagging potential vulnerabilities like "Bypassed!" enforcement statuses. Users can configure interception filters, integrate with Burp's Repeater, and fine-tune enforcement detectors to identify issues such as unauthorized access to administrative functions by checking for 401 status codes. → danaepp.com |
| 2024-09-16 2024 | Automating the CORS Vulnerability Scan intermediate API Sec Bug Bounty | When conducting a bug bounty, automating your scanning process not only saves time but ensures you don’t miss common vulnerabilities. One… |
| 2023-09-03 2023 | GitHub - dirkjanm/adidnsdump: Active Directory Integrated DNS dumping by any authenticated user intermediate AuthN | Tool for Active Directory Integrated DNS record enumeration and export, enabling reconnaissance of internal networks. By default, any authenticated Active Directory user can perform zone transfers, and this application facilitates that capability. It can be installed via pip or from source, requiring impacket and dnspython. The tool supports direct network use and proxychains, with an option for DNS over TCP. |
| 2023-09-01 2023 | Spraying the Microsoft Cloud intermediate AuthN | Adversaries continue to probe and make entry via the cloud perimeter of organisations. Multi-Factor Authentication (MFA) and additional… |
| 2023-05-21 2023 | Authentication authorization and security in SharePoint intermediate 4 min read AuthN | Reference on SharePoint authentication and authorization, detailing its role-based security model and support for Windows authentication (including NTLM and Kerberos) and ASP.NET forms-based authentication. It highlights claims-based identity as a core feature, enabling cross-platform authentication and integration with external identity systems, and explains how membership and role providers are utilized to manage user identities and group memberships. |
| 2023-05-09 2023 | Seven Common Ways To Bypass Login Page intermediate AuthN | Seven Common Ways To Bypass Login Page https://ift.tt/8PI0ers |
| 2023-04-13 2023 | OWASP Proactive Controls 2023/2024 v1 beginner API Sec AuthN | OWASP Proactive Controls 2023/2024 v1 https://ift.tt/xVAnFY5 → docs.google.com |
| 2023-03-29 2023 | skills/secure-code-game beginner 1 min read Bug Bounty | Library for learning secure coding through an interactive in-editor game. Season 4 focuses on securing Agentic AI, teaching how to protect Agentic Workflows and Multi-Agent Communications through five progressive levels. Players can start quickly from their browser, with no AI or coding experience required. The game runs instantly in GitHub Codespaces, with over 10,000 players participating from industry and academia. |
| 2022-04-14 2022 | Favorite tweet by @Jhaddix intermediate Bug Bounty | Favorite tweet: 🧵Another hacker story thread!🧵 === Penetrating a Porn Site === How I hacked access to the most sensitive areas of a porn site using only low severity vulnerabilities. Here's how I did... |
| 2021-11-10 2021 | How to Control Access to Your Amazon Elasticsearch Service Domain intermediate 12 min read | Reference for controlling access to Amazon OpenSearch Service (formerly Amazon Elasticsearch Service) domains. It details how to leverage AWS Identity and Access Management (IAM) through resource-based policies and identity-based policies. The entry also covers authentication strategies, including IP-based restrictions and Signature Version 4 signing, with examples for both Python and Java. → aws.amazon.com |
| 2021-10-29 2021 | Improvements to Burp Suite authenticated scanning intermediate 4 min read Burp | Library improvements in Burp Suite 2021.9.1 enhance authenticated scanning by better handling iframes, animated elements, JavaScript-driven redirections, nested SVGs within buttons, and multi-select elements, leveraging the Burp Suite Navigation Recorder for complex login sequences. → portswigger.net |
| 2021-09-14 2021 | IAM Vulnerable intermediate 7 min read | Tool for creating a vulnerable-by-design AWS IAM privilege escalation playground. Using Terraform and your AWS credentials, it deploys over 250 IAM resources to facilitate learning and exploitation of 31 unique privilege escalation paths, referencing techniques pioneered by Spencer Gietzen and applicable to tools like Cloudsplaining and Pacu. |
| 2021-09-07 2021 | Automating Authorization Testing: AuthMatrix Part 1 intermediate 2 min read Bug Bounty | Library for automating authorization testing. This resource, AuthMatrix Part 1, introduces a technique for comprehensively testing application authorization by creating custom matrices to cover all possible user role and permission combinations, effectively identifying and mitigating authorization bypass vulnerabilities. → whiteoaksecurity.com |
| 2021-07-28 2021 | Chaining password reset link poisoning IDOR and information leakage to achieve account takeover at api.redacted.com advanced Bug Bounty IDOR | This report details a method to achieve account takeover at api.redacted.com by chaining three vulnerabilities. The attacker first exploits password reset link poisoning, then an Insecure Direct Object Reference (IDOR) flaw, and finally leverages information leakage. These combined vulnerabilities allow for unauthorized access to user accounts. |
| 2021-07-19 2021 | AWS IAM Role Chaining intermediate | AWS IAM Role Chaining allows one IAM role to assume another IAM role. This enhances security by enabling temporary, limited-privilege credentials to be granted for specific tasks. Instead of managing separate policies for every user and service, roles can be chained together, where Role A assumes Role B. This promotes the principle of least privilege, reducing the potential attack surface. The primary benefit is improved security and streamlined credential management within AWS environments. |
| 2021-06-30 2021 | Forbidden You dont have permission to access / on this server Error beginner 4 min read | Reference on resolving the Apache "Forbidden – You don’t have permission to access / on this server" error. This guide addresses common causes such as incorrect file/directory permissions, misconfigurations in Apache's main configuration files, and improperly formatted .htaccess files. Solutions include recursively adjusting file permissions with `chmod 755` for directories and `chmod 644` for files, modifying ownership with `chown`, and ensuring `AllowOverride All` is set in Apache's `<Directory>` directives. |