IDOR in banking APIs: the bug that keeps paying out
Broken object-level authorization is still the most common finding in our fintech VAPT reports. How to test for it.
An insecure direct object reference (IDOR) lets one user read or change another user’s data by changing an ID in a request. In banking that can mean another customer’s statement or beneficiary list.
How to test for it
Log in as two users. Capture a request from user A that contains an object ID, such as /api/accounts/1043/statements. Replay it with user B’s session. If it succeeds, the API checks authentication but not ownership.
What to recommend
Check ownership on the server for every object, use non-guessable IDs as a second layer, and add automated tests that replay requests across users before every release.
Security Testing Essentials
Find vulnerabilities in web apps and APIs the way an attacker would, then report them properly.
See the course