API10:2023: Unsafe Consumption of APIs
Trusting third-party API responses without validation. Compromised partner APIs become a vector into the consuming application.
How it's found
Found by tracing outbound calls the target makes to third-party APIs and checking for missing schema validation and unverified TLS trust.
Standards mapping
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is API10:2023 Unsafe Consumption of APIs?
Trusting third-party API responses without validation. Compromised partner APIs become a vector into the consuming application.
How do you find Unsafe Consumption of APIs?
Found by tracing outbound calls the target makes to third-party APIs and checking for missing schema validation and unverified TLS trust.
Which CWEs map to API10:2023?
API10:2023 maps to CWE-441, CWE-829, CWE-20.
Does TurboPentest test for Unsafe Consumption of APIs?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related OWASP categories
- OWASP API Security Top 10API1:2023: Broken Object Level Authorization
- OWASP API Security Top 10API2:2023: Broken Authentication
- OWASP API Security Top 10API3:2023: Broken Object Property Level Authorization
- OWASP API Security Top 10API4:2023: Unrestricted Resource Consumption
- OWASP API Security Top 10API5:2023: Broken Function Level Authorization
- OWASP API Security Top 10API6:2023: Unrestricted Access to Sensitive Business Flows
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest