The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API

T1Covered by 1 source · first reported by Wiz Research at 29 Jun, 09:31 UTC

Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes

devsecurity

Sources

• T1The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL APIWiz Research29 Jun, 09:31