6 posts tagged with "Authorization"

What is the first step of attacking an MCP server? Nearly every single one answers a question for free, to anyone who asks: what can you do here? The response, tools/list, is usually treated as a harmless discovery mechanism. We wanted to challenge that and see how far schema-based recon can really get us. A tool list is a capability disclosure, and reading it carefully, without ever calling a single tool, can tell you more about a server's risk than you'd expect. This article develops a threat model for exactly that, then we test it against 234 public MCP servers to see how much of it holds up.

Proof of exploitability, or it didn't happen​

One of the most pervasive problems in cybersecurity is false positives. Organisations receive dozens of bogus vulnerability reports about their websites every day, and security teams burn hours trudging through the noise that automated scanners generate. Worse, CISOs can't prioritise what actually matters, because a false positive is so often hard to tell apart from a real finding.

How did we go so wrong? The ingredient missing from a false positive is proof of exploitability, and a rigorous one at that. Proof of exploitability, also called chain-of-attack proof, is one of the most important elements of any vulnerability report. Without it, a penetration testing report isn't worth your money. Reliable bug bounty platforms like HackerOne place heavy emphasis on proving a vulnerability is exploitable; without that ingredient, a report simply doesn't have a case.

Multi-agent systems are starting to look a lot like distributed systems with personalities, tools, and very different privilege levels. In Google ADK, we found that a remote A2A peer could supply forged control metadata that influences agent routing, session state, and even conversation history, creating a path for a fresh sort of privilege escalation. As AI agents gain more autonomy and access to real tools, how much trust should a framework place in control instructions that arrive from another agent?

A security scanner reports: 3,148 authorization requests are missing PKCE.

…and suddenly that sounds like 3,148 vulnerabilities. Or is it?

A one-sentence message was enough to hijack accounts worth six figures on the resale market. A senior Space Force officer's Instagram account, the dormant Obama-era White House handle, and a six-figure username market all fell to the same three-month-old bug. The headlines called it prompt injection, but is that actually what happened?

In March 2026, Meta rolled out a fully agentic AI support assistant across Facebook and Instagram. This was not a chatbot that simply answers questions, but one with operational privileges, including the ability to act on account recovery requests directly. By February, attackers had already found the gap, and the exploit only needed a sentence.

Your API has a bouncer. Very professional. Checks every ID at the door. Unfortunately, once you're inside, you can walk into the kitchen, rearrange everything, and delete someone else's reservation and he's still at the front door, extremely proud of himself.

Most security teams know what BOLA is. Broken Object Level Authorization, the vulnerability where an API doesn't verify that you're allowed to access the specific object you're referencing, not just the endpoint. It has sat at the top of the OWASP API Security Top 10 since 2019. There are guides, courses, and CTF challenges built around it.

And yet we analyzed over 100 validated, publicly disclosed bug bounty reports from HackerOne spanning 2021 to 2026, across 29 organizations including GitHub, GitLab, Shopify, Mozilla, and more, and found something that should give every security team pause.

The way most teams are testing for BOLA doesn't match how BOLA actually shows up in the wild. Here's what the data says.

First, a Quick Note on the Tag Noise​

One number worth flagging: roughly 39% of reports tagged IDOR or Improper Access Control on HackerOne don't describe BOLA under rigorous criteria. Wrong vulnerability class entirely, auth bypass without object reference, business logic on a user's own resources. If your team is using platform tag-counts to estimate BOLA exposure, you're likely overstating the signal significantly. Hence, these were excluded under the prefilter criteria of our research.

Finally, the 84 confirmed, in-scope reports are what everything below is drawn from. The full dataset, classification methodology, and analysis scripts are available on GitHub.