OWASP API Security Top 10 (2023)

Attackers manipulate object IDs in API requests to access objects belonging to other users. The most prevalent and impactful API vulnerability.

Authentication mechanisms that are flawed, missing, or implemented incorrectly. Includes weak credential handling, missing rate limits on auth endpoints, JWT validation flaws.

Combines the former Excessive Data Exposure (over-returning fields) and Mass Assignment (over-accepting fields) into one category covering field-level authorization failures.

APIs without quotas, rate limits, or resource-cost controls allow DoS, financial loss (cloud bill exhaustion), or quota exhaustion attacks.

Attackers can call admin/elevated functions with regular-user credentials by manipulating endpoints or HTTP methods.

Business flows (purchase, ticket-buying, comment-posting) that can be abused at scale by automation despite individual requests being authorized.

API fetches a remote resource without validating the user-supplied URL, allowing attackers to make the server reach internal/cloud-metadata endpoints.

Insecure defaults, incomplete configuration, open cloud storage, missing security headers, verbose errors, unpatched systems.

Old API versions, undocumented endpoints, debug/staging APIs left exposed alongside production. Inventory drift creates a wider attack surface than the documented API.

Trusting third-party API responses without validation. Compromised partner APIs become a vector into the consuming application.