APPSEC-PELOTON-API-2021

nOAuth, disclosed by Descope's security team on June 20, 2023 (reported to Microsoft on April 11, 2023), is a cross-tenant account-takeover class in multi-tenant Microsoft Entra ID (Azure AD) OAuth applications, mapping to OWASP API2:2023 Broken Authentication. The flaw existed because Entra ID emitted an 'email' claim in the OIDC token that was both mutable and unverified, while applications used that email rather than the immutable 'sub'/'oid' claim to identify and link the signed-in user. An attacker who controlled their own Entra tenant could set the email attribute of an attacker account to a victim's email address, then use 'Log in with Microsoft' against any vulnerable app; the app merged accounts by the spoofed email and granted full control of the victim's account, requiring no interaction from the victim. Descope confirmed real exposure in major SaaS apps including a design platform with millions of monthly users. Microsoft mitigated by no longer emitting unverified email claims by default for app registrations created after June 2023 and added the xms_edov claim and a RemoveUnverifiedEmailClaim flag.

On January 19, 2023 T-Mobile disclosed in an SEC 8-K filing that an attacker had abused a single API to obtain data on roughly 37 million current postpaid and prepaid customer accounts, with access beginning on or around November 25, 2022 and continuing about six weeks until detection on January 5, 2023 and cutoff a day later. The exposed fields included names, billing addresses, emails, phone numbers, dates of birth, account numbers, and plan features; T-Mobile stated no passwords, payment card data, Social Security numbers, or government IDs were taken. T-Mobile only stated that a bad actor obtained data through a single API without authorization, without publishing the low-level mechanism; the security-community consensus reconstruction is Broken Object Level Authorization (BOLA/IDOR), where the API returned per-customer records without verifying the caller was authorized for that specific object, letting the attacker walk through customer identifiers at scale. The mechanism maps to BOLA via a user-controlled key, or, if the endpoint lacked authorization entirely, to missing authorization.

On January 3, 2023 Sam Curry and a team of researchers published Web Hackers vs. The Auto Industry, documenting critical API authorization flaws across about 16 automakers including Kia, Hyundai, Honda, Nissan, Acura, Infiniti, BMW, Ferrari, Porsche, Rolls Royce and Mercedes-Benz, plus telematics providers such as SiriusXM Connected Vehicle Services and Spireon. The connected-car APIs treated the VIN, which is visible through the windshield and effectively public, as an object identifier without verifying the caller actually owned the vehicle, a Broken Object Level Authorization flaw. Using only a target VIN, researchers could enroll a vehicle to an attacker account or bypass ownership checks and then remotely unlock, start, locate, honk, and track vehicles, achieving full account takeover. Several manufacturers also had Broken Function Level Authorization and misconfigured SSO/OTP endpoints exposing internal dealer portals. The work maps to OWASP API1:2023 (BOLA) and API5:2023 (BFLA).

In February 2022, a researcher known as Tree of Alpha reported a business-logic flaw in Coinbase's Retail Advanced Trading API through HackerOne, earning a $250,000 bounty that Coinbase described as its largest ever. Coinbase stated the underlying cause was a missing logic validation check in a Retail Brokerage API endpoint that allowed a user to submit trades to a particular order book using a mismatched source account. Because the order-validation logic never verified that the named source account actually held the asset being sold, a user could place sell orders for a cryptocurrency they did not own; the reproduction example sold one asset while sourcing it from an account holding a different token. This maps to OWASP API6:2023 Unrestricted Access to Sensitive Business Flows, an improper-validation business-logic error rather than a missing cryptographic or session control. Coinbase reproduced the bug, halted retail advanced trading into cancel-only mode within an hour of the report, and validated a patch the same day.

In 2019, researcher Laxman Muthiyah found an account-takeover flaw in Instagram's mobile password-recovery flow, which Facebook rewarded with a $30,000 bounty, mapping to OWASP API4:2023 Unrestricted Resource Consumption combined with broken authentication. The flow sent a six-digit recovery code to the user's phone, giving only 1,000,000 possible values, and its rate limiting was insufficient to stop high-volume guessing. Muthiyah observed that of 1,000 codes submitted from one IP, about 250 were processed while the rest were throttled, so per-IP limits alone did not cap total attempts. By combining a race condition with IP rotation, he sent roughly 200,000 concurrent requests from 1,000 different IP addresses and estimated about 5,000 IPs would suffice to cover the full code space within the 10-minute validity window, brute-forcing the code and taking over any account. The core defect was the absence of an effective global lockout tying failed attempts to the targeted account rather than only the source IP.

On November 21, 2018 Krebs on Security reported that a USPS Informed Visibility API had exposed account data on roughly 60 million usps.com users, after a researcher's warning had gone unanswered for over a year until USPS fixed it on November 20, 2018. The API enforced authentication but no object-level authorization: any logged-in usps.com account holder could query the account details of any other user, and the same promiscuous endpoint allowed requesting account changes such as email, phone number, and other details for arbitrary users. Many API features also accepted wildcard search parameters, so a single query could return entire data sets at once. Exposed fields included email address, username, user ID, account number, street address, phone number, authorized users, and mailing-campaign data. This is a Broken Object Level Authorization / IDOR flaw with a missing-authorization root cause: authentication was checked but authorization on the target object was not.