Critical Auth Bypass in Global Payments Platform

Engagement Overview

A Series B fintech company processing $2B+ annually required a full-scope web application penetration test before their institutional investor security audit.

Challenge

The platform had grown rapidly with multiple engineering teams. Legacy API endpoints from an acquisition had never been fully reviewed. The security team suspected inconsistent auth enforcement but lacked the tooling to confirm.

Methodology

1. Reconnaissance — passive OSINT, subdomain enumeration, endpoint discovery via JavaScript analysis
2. Authentication testing — JWT manipulation, session fixation, IDOR across customer accounts
3. Business logic — payment flow manipulation, balance tampering attempts
4. Infrastructure — cloud misconfiguration review (AWS S3, IAM policies)

Findings

• Critical: Broken object-level authorization on legacy /v1/ API — any authenticated user could access another user’s transaction history by iterating account IDs
• High: JWT algorithm confusion vulnerability allowing token forgery
• Medium (×4): Sensitive data in server responses, missing rate limiting on auth endpoints

Outcome

The critical IDOR was patched within 48 hours. A CVE was issued for the JWT vulnerability. The company passed their investor security audit. No breach occurred. Full remediation verified in a retest 30 days later.