AuthZ learning path

Orientation and first principles — what the bug class is and how it behaves.

1. Insecure Direct Object Reference (IDOR) Attack Guide | Hackviser
   7 min readhackviser.com2026
   Guide to Insecure Direct Object Reference (IDOR) vulnerabilities, detailing manual testing techniques across URL parameters, POST bodies, HTTP headers, cookies, and file access. It covers automated discovery using tools like Burp Suite and ffuf, scripting with Python, and various attack vectors including numeric, UUID, hash-based, parameter pollution, and mass assignment bypasses, as well as blind IDOR exploitation.
2. Preventing broken access control in express Node.js applications
   11 min readsnyk.io2026
   Library detailing broken access control vulnerabilities in Express Node.js applications, covering scenarios like unprotected admin panels, predictable user IDs leading to IDOR, and insecure direct object references. It illustrates how to prevent issues such as vertical privilege escalation and horizontal data exposure, emphasizing the risks of clear text logging and insufficient CSRF protection within Express middleware.
3. RBAC vs ABAC vs ReBAC: How to Choose Access Control Models
   12 min readdev.to2026
   Library comparing Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Relationship-Based Access Control (ReBAC). It details how RBAC, while simple, suffers from "Role Explosion" due to complexity in systems like AWS IAM and Kubernetes. ABAC is presented as a solution, using attributes and dynamic evaluation instead of static roles, exemplified by OPA and AWS IAM's Condition blocks. ReBAC principles are also touched upon, particularly in the context of Azure's resource hierarchy inheritance.
4. Defending Against Broken Access Control
   10 min readauthgear.com2026
   Library for defending against Broken Access Control (BAC), the #1 threat (A01:2021) in the OWASP Top 10. This vulnerability occurs when applications fail to enforce authorization, allowing unauthorized users to access data or functions. Learn about common attack techniques like Horizontal and Vertical Privilege Escalation, Parameter Tampering, IDOR, Data Exposure, API Abuse, and BOLA. The resource highlights real-world examples such as the Optus data breach and the Kia vehicle control vulnerability, emphasizing the critical need for robust server-side authorization.
5. Why Broken Access Control Dominates OWASP Top 10 in 2026
   7 min readauth0.com2026
   Library for building secure applications, focusing on mitigating Broken Access Control (BAC) and Broken Object Level Authorization (BOLA). It highlights how traditional SAST and DAST tools struggle with these logic flaws, contrasting them with technical vulnerabilities like SQL Injection. The library advocates for centralized authorization logic using the Policy Decision Point (PDP) and Policy Enforcement Point (PEP) pattern, and promotes Policy as Code (PaC) with tools like Auth0 FGA, OpenFGA, and OPA to manage authorization policies externally from application code.

Real testing methodology, tooling, and writeups that show the work.

1. Authorization Testing Automation Cheat Sheet - OWASP
   10 min readcheatsheetseries.owasp.org2026
   Cheat sheet offering a methodology for automating authorization tests by formalizing an authorization matrix in XML. This approach enables the creation of integration tests that validate access controls for REST services across different logical roles like ANONYMOUS, BASIC, and ADMIN. The process involves defining roles, services with their associated permissions, and test payloads to ensure new feature additions or modifications do not conflict with existing authorization definitions.
2. Authorization Cheat Sheet - OWASP
   18 min readcheatsheetseries.owasp.org2026
   Cheatsheet providing guidance for robust authorization logic, addressing concerns like Broken Access Control, a top OWASP 2021 vulnerability. It details implementing "Least Privileges" by granting only necessary permissions and adopting a "Deny by Default" approach for all requests, emphasizing the need for validation on every interaction to prevent unauthorized access to resources, which can impact confidentiality, integrity, and availability.
3. Local Privilege Escalation To System In Wibu-Systems CodeMeter Application
   8 min readshelltrail.com2026
   Library for privilege escalation targeting Wibu-Systems CodeMeter. This library details a method to achieve SYSTEM privileges from a low-privileged session by leveraging CodeMeter's `cmu.exe` to create files under `C:\CM-Stick`. Through a directory symlink hijack, this capability becomes an arbitrary file delete. Combined with the `::\$INDEX_ALLOCATION` NTFS trick and the Windows Installer's `C:\Config.Msi` rollback technique, it enables a full local privilege escalation to SYSTEM.
4. How I Found a Cross-Student IDOR in Academy LMS That Leaked Correct Quiz Answers
   8 min readinfosecwriteups.com2026
   Writeup detailing a Cross-Student Insecure Direct Object Reference (IDOR) vulnerability in the Academy LMS WordPress plugin, specifically affecting the quiz attempt details endpoint. Exploiting this flaw allowed any enrolled student to retrieve another student's quiz results and learn the correct answers to quiz questions, by passing the victim's `user_id` to the `get_student_quiz_attempt_details` function, bypassing authorization checks that incorrectly used the victim's enrollment status.
5. Privilege escalation to root in Lima QEMU guests via a world-writable agent socket (CVE-2026-53657)
   7 min readsyntetisk.tech2026
   Writeup detailing CVE-2026-53657, a privilege escalation vulnerability in Lima's QEMU guest agent. An unprivileged user within a QEMU guest could exploit a world-writable, root-owned socket to execute commands as root due to a lack of authentication on the agent's gRPC API and a forwarding RPC. This vulnerability only affects the QEMU driver, not the default VZ driver. Lima v2.1.3 addresses this by restricting socket permissions and ownership.

Novel research, edge cases, and the techniques that push the class forward.

1. Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA
   9 min readgoteleport.com2026
   Framework for dynamically evaluating authorization policy engines, including Rego, Cedar, OpenFGA, and Teleport ACD. This system automates security benchmarking and robustness testing by executing predefined test cases in isolated Docker containers for each engine, comparing actual results against expected outcomes to identify potential threats and vulnerabilities.
2. Windows AppResolver LPE: From AppContainer to SYSTEM. PoC linked to CVE-2026-50454
   9 min readdavidcarliez.github.io2026
   Writeup details a Local Privilege Escalation (LPE) technique in Windows, bypassing User Account Control (UAC) by exploiting a missing authorization check in `Windows.Internal.AppResolver.AppResolverActivationArgsFactory`. An attacker can leverage a zero-capability AppContainer to register a malicious handler for `ms-settings:`, which is then auto-elevated via `fodhelper.exe` using the administrator's token, ultimately leading to a SYSTEM-privileged process. This technique is associated with CVE-2026-50454, though the author notes it differs from the publicly described relative path traversal vulnerability.
3. Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking
   12 min readinfosecwriteups.com2026
   Library for Confused Deputy exploit in Google IdP, enabling universal account takeover via device code flow hijacking. This vulnerability allows an attacker to silently steal an access token for an arbitrary Google-registered client, bypassing consent screens and 2FA, by chaining two bugs: session transferability via a crafted URL and the authorization server’s failure to bind `client_id` and `scope` server-side to the `device_code`. The initial report to Google's VRP was initially rejected but later fixed after a one-click Proof of Concept was developed.
4. GhostApproval: A Trust Boundary Gap in AI Coding Assistants
   10 min readwiz.io2026
   Library addressing GhostApproval, a trust boundary gap in AI coding assistants, where symlink following (CWE-61) combined with UI misrepresentation (CWE-451) allows malicious repositories to trick agents like Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf into writing to arbitrary files outside the sandbox, potentially leading to remote code execution.
5. BadSuccessor — Exploiting delegated Managed Service Accounts in Windows Server 2025
   8 min readinfosecwriteups.com2026
   Library for exploiting delegated Managed Service Accounts (dMSAs) in Windows Server 2025, detailing the "BadSuccessor" vulnerability. This flaw arises from missing permission checks, allowing low-level users with `CreateChild` rights on an OU to create a dMSA and link it to a privileged account. The system then incorrectly grants the dMSA all of the predecessor's permissions during Kerberos ticket issuance, enabling privilege escalation to high-level administrative roles.
6. A Deep Dive into the GetProcessHandleFromHwnd API
   14 min readprojectzero.google2026
   Reference detailing the `GetProcessHandleFromHwnd` API's evolution, tracing its implementation from a user-mode function in `oleacc.dll` utilizing Windows hooks in Vista to a kernel-mode function `NtUserGetProcessHandle` in `win32kfull.sys` in Windows 10. The analysis highlights discrepancies between documentation and actual behavior, including UAC bypass possibilities and integrity level checks enforced by the kernel function.
7. Broken Authentication: Advanced Exploitation Guide | Intigriti
   9 min readintigriti.com2026
   Guide to exploiting broken authentication vulnerabilities, this resource covers identifying and exploiting common and advanced flaws. It details techniques like forced browsing, utilizing default credentials, and leveraging lack of rate limiting for brute-forcing. The guide also explains how input validation issues, such as SQL injection, can lead to authentication bypasses, providing examples for practical application.
8. gadievron/raptor: Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations.
   7 min readgithub.com2026
   Library for autonomous security research, RAPTOR orchestrates static analysis, binary analysis, LLM-powered vulnerability validation, exploit generation, and patch writing. It integrates Semgrep and CodeQL for scanning and utilizes LLMs for vulnerability analysis, generating Proof-of-Concepts, and creating patches. RAPTOR supports multiple LLM providers and can leverage Z3 for constraint analysis to improve accuracy and prioritize reachable exploits. It offers project management features for organizing findings and tracking progress across multiple runs.