APPSEC-COINBASE-TRADE-LOGIC-2022

On January 19, 2023 T-Mobile disclosed in an SEC 8-K filing that an attacker had abused a single API to obtain data on roughly 37 million current postpaid and prepaid customer accounts, with access beginning on or around November 25, 2022 and continuing about six weeks until detection on January 5, 2023 and cutoff a day later. The exposed fields included names, billing addresses, emails, phone numbers, dates of birth, account numbers, and plan features; T-Mobile stated no passwords, payment card data, Social Security numbers, or government IDs were taken. T-Mobile only stated that a bad actor obtained data through a single API without authorization, without publishing the low-level mechanism; the security-community consensus reconstruction is Broken Object Level Authorization (BOLA/IDOR), where the API returned per-customer records without verifying the caller was authorized for that specific object, letting the attacker walk through customer identifiers at scale. The mechanism maps to BOLA via a user-controlled key, or, if the endpoint lacked authorization entirely, to missing authorization.

On January 3, 2023 Sam Curry and a team of researchers published Web Hackers vs. The Auto Industry, documenting critical API authorization flaws across about 16 automakers including Kia, Hyundai, Honda, Nissan, Acura, Infiniti, BMW, Ferrari, Porsche, Rolls Royce and Mercedes-Benz, plus telematics providers such as SiriusXM Connected Vehicle Services and Spireon. The connected-car APIs treated the VIN, which is visible through the windshield and effectively public, as an object identifier without verifying the caller actually owned the vehicle, a Broken Object Level Authorization flaw. Using only a target VIN, researchers could enroll a vehicle to an attacker account or bypass ownership checks and then remotely unlock, start, locate, honk, and track vehicles, achieving full account takeover. Several manufacturers also had Broken Function Level Authorization and misconfigured SSO/OTP endpoints exposing internal dealer portals. The work maps to OWASP API1:2023 (BOLA) and API5:2023 (BFLA).

On May 5, 2021 Pen Test Partners researcher Jan Masters and TechCrunch publicly disclosed that Peloton's API exposed the private account data of its users, having been reported privately to Peloton on January 20, 2021. The API had endpoints, including a workout-details POST endpoint, a user-search GET endpoint, and GraphQL endpoints, that performed no authorization checks: unauthenticated requests returned account data such as user IDs, location/city, age, gender, weight, workout statistics, birthday, and group/studio attendance, even for users who had set their profiles to private, because the privacy flag was not enforced at the API layer. This is a missing/insufficient-authorization flaw on an API serving over 3 million subscribers' data. A partial fix on February 2, 2021 only restricted the API to authenticated Peloton members, so anyone willing to create an account could still pull any other user's private data until the full fix around early May.

On November 21, 2018 Krebs on Security reported that a USPS Informed Visibility API had exposed account data on roughly 60 million usps.com users, after a researcher's warning had gone unanswered for over a year until USPS fixed it on November 20, 2018. The API enforced authentication but no object-level authorization: any logged-in usps.com account holder could query the account details of any other user, and the same promiscuous endpoint allowed requesting account changes such as email, phone number, and other details for arbitrary users. Many API features also accepted wildcard search parameters, so a single query could return entire data sets at once. Exposed fields included email address, username, user ID, account number, street address, phone number, authorized users, and mailing-campaign data. This is a Broken Object Level Authorization / IDOR flaw with a missing-authorization root cause: authentication was checked but authorization on the target object was not.

On September 28, 2018 Facebook disclosed that attackers had stolen access tokens by exploiting its View As feature; an initial estimate of nearly 50 million affected accounts was revised on October 12, 2018 to about 30 million whose tokens were actually stolen (roughly 29 million had data accessed). The root cause was a business-logic flaw chaining three bugs in the read-only View As profile preview: a video-uploader composer added in July 2017 wrongly appeared in that view, it incorrectly minted an access token at all, and critically it minted the token for the user being viewed rather than the viewer, embedding that token in the page HTML. An attacker could therefore select View As a target and scrape a fully privileged token for the target account, then pivot through friend lists to harvest tokens outward from roughly 400,000 seed accounts. The flaw is an improper-authentication / business-logic failure where an auth credential was generated in the wrong context and scoped to the wrong principal.

A source map (.map) is a build artifact that maps minified bundle code back to the original source, and bundlers embed the full original code in its sourcesContent field. Left reachable in production or shipped inside a package, it hands anyone the unminified codebase, internal comments, hidden API endpoints, auth logic, and any secrets that were compiled in. Discovery is trivial: open DevTools and read the Sources tab, request the bundle's .map URL directly, or Google-dork for ext:map intext:webpack, then reconstruct the whole project with a tool like unwebpack-sourcemap. Passive scanners such as Acunetix and Burp already flag it as a standalone finding. It is usually rated medium on its own but escalates fast when the recovered source contains live credentials or undocumented endpoints; exposed Webpack source maps have leaked hardcoded Stripe secret keys that enabled unauthorized payments. High-profile cases include Apple's App Store web front-end in November 2025, shipped with source maps still enabled, and Anthropic's Claude Code, whose entire TypeScript source leaked via a source map left in a published npm package in March 2026.