This is Part 2 of an ongoing series where we’ll learn GraphQL from an attacker’s perspective. Each article builds on the previous one, so…

In this lab from PortSwigger’s Web Security Academy, the goal was simple: find the hidden private blog post and extract its secret…

Series Overview Part 1 — Recon, Discovery & Mapping the Attack Surface Part 2a — Breaking Authentication & Authorization Part 2b —…

Most of mine got closed as "informational." These five actually pay - from a $5K IDOR to a $12,500 account takeover. Plus what to skip.

Still an Admin. Just Not Officially

Disclaimer:This write-up describes a vulnerability that has been responsibly disclosed and fixed by the affected organization. All domains…

A real-world bug bounty walkthrough on how skipping WebSocket recon is leaving money on the table — and how I found a P1 by going where…

Disclaimer:This write-up describes a vulnerability that has been responsibly disclosed and fixed by the affected organization. All domains…

Chaining unauthenticated mutations, GraphQL batching abuse, and IDOR into full cross-tenant compromise

How a seemingly harmless GraphQL query exposed private user history and highlighted the importance of authorization in nested resolvers.

TL;DR A high-severity authentication bypass affects the Neo4j GraphQL Library before versions 7.5.6 and 5.12.14. Tracked as CVE-2026-5423 (CVSS 8.2), it lets an unauthenticated attacker forge JWT …

How design, security, and monetization are redefining what an API is for