PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How a GraphQL Bug Resulted in Authentication Bypass

hackerone.com | vulnerability | #bug-bounty | #access-control | #authentication-bypass | #privilege-escalation | #api-security | #graphql | #e-commerce
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A researcher abused a GraphQL API with weak access control as an alternate channel to bypass authentication and escalate to admin in an e-commerce app, exposing promo banner and product data.
Published
Collected

Related coverage

Critical · vulnerability · github.com
CVE-2026-19478 GitLab GraphQL unauthenticated project deletion
This vulnerability allows remote unauthenticated actors to delete projects in vulnerable GitLab instances, necessitating immediate patching.
blog · wiz.io
The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
Part 2 of the Red Agent POV series: an autonomous BOLA exploit against an airline's GraphQL booking API used sequential IDs to read two years of passenger records and even modify live bookings.
blog · labs.cognisys.group
The Golden Role How a Simple API Logic Flaw Unlocked an Entire SaaS Platform
In a true black-box assessment, the engagement begins with minimal information: a target URL and no prior knowledge of the application’s architecture, credentials, or codebase. During a recent engagement targeting a multi-tenant SaaS platform, our initial objective was to establish initial access through standard user provisioning.
blog · samcurry.net
Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office
Sam Curry recounts breaching ClubWPT Gold's back office: a stray Chinese dev domain in the poker site's JavaScript led to an admin portal with broken auth exposing IDs, passports and transactions.
blog · blog.viettelcybersecurity.com
Broken access control in GoAnywhere Admin portal
A GoAnywhere Admin Portal access-control flaw lets attackers bypass SecurityFilter using path traversal (/a/../) and reach the setup page, enabling unauthenticated creation of an admin account.
research · slcyber.io
Exploiting GraphQL
A guide to exploiting GraphQL APIs: finding endpoints, introspection enumeration and bypass, batching attacks, CSRF, and authorization vulnerabilities.
Back