An API vulnerability is a weakness, flaw, or defect that an attacker can exploit to weaken system security. It can expose business assets, enable unauthorized use, or bypass intended protections. Security checks therefore belong across API design, development, testing, and runtime operation. section 10.2.1
Threat modeling distinguishes vulnerability from related security concepts:
- A threat is a potential occurrence that could damage or compromise a business asset. section 10.2.1
- An attack executes a threat by attempting to steal, expose, modify, destroy, disable, or gain unauthorized access to a system or asset. section 10.2.1
- A countermeasure addresses vulnerabilities to reduce attack probability or the impact of threats. section 10.2.1
- An attack vector is the channel used to carry out an attack, such as a client browser or network proxy. section 10.2.1
API security protects information and business assets through mechanisms such as encryption, authentication, authorization, audit logging, and rate-limiting. Vulnerability risk depends on both likelihood and impact; a low-probability, high-impact weakness can outweigh a frequent but minor problem. section 10.2.1
Design-time vulnerability review
An intentionally insecure OpenAPI definition from the OWASP Completely Ridiculous API project provides a review target. Analysts inspect its API design for security defects before examining the full service implementation, using the exposed car-service, account, purchasing, and community features as context. section 10.2
Static security testing finds design-time vulnerabilities by applying security-focused linting rules to API definition files. A pull-request build can enforce this review, while commercial platforms can scan definitions for authentication, authorization, transport, and payload practices and impose a minimum security score. section 8.11.6
Figure 10.5 The Top 10 API security risks identified by OWASP
Browse the OWASP Top 10 API security risks as a practical catalogue for recognizing recurring vulnerability patterns. section 10.2.1
