An API vulnerability is a weakness in an API or its surrounding implementation that attackers can exploit to compromise confidentiality, integrity, availability, or authorization. APIs expose sensitive data and operations, so vulnerabilities can create risks that traditional application-security recipes do not fully address. section 1.7 section 4.0
Common API vulnerability areas include:
- Authentication and authorization weaknesses that allow unauthorized access. section 4.0
- Role-based access-control flaws that grant inappropriate privileges. section 4.0
- Unintended data updates and sensitive-data leaks. section 4.0
- Business-logic abuse that exploits permitted API behavior. section 4.0
Mitigation combines secure design, careful implementation, authorization controls, automated vulnerability identification, secure operations, and observability that detects malicious activity. section 1.7
