API Security Roundup: BOPLA in F1, WSO2 API Manager, Better-Auth Plugin
Multiple API authorization failures: (1) FIA (Formula 1 governing body) registration portal had Broken Object Property Level Authorization—excessive data exposure leaked hidden properties (user role, status) in PUT responses, then mass assignment allowed attackers to change their role to administrator, accessing Max Verstappen's PII. (2) WSO2 API Manager missing method contexts exposing admin-level operations without authentication—attackers could gain administrative privileges via unauthenticated API calls. (3) Better-Auth plugin logic error: API key creation accepted either valid session OR valid user ID, so unauthenticated users knowing/guessing another user's ID could retrieve their API key. (4) Moxa industrial networking devices had BFLA (Broken Function Level Authorization) where missing authorization checks let low-privileged users access admin functions, modify configs, and create admin accounts. Common thread: authorization failures assume authenticated users are authorized, or bypass authentication entirely through logic flaws.
CORTEX Protocol Intelligence Assessment
BOPLA (Broken Object Property Level Authorization) is becoming the dominant API vulnerability class—combining excessive data exposure with mass assignment. The pattern: APIs leak more data than intended, attackers observe hidden fields, then send those fields back in requests to modify unauthorized properties. The Better-Auth case shows why every conditional should be AND, not OR, when checking access controls.
Strategic Intelligence Guidance
- Implement schema-based input/output validation: explicitly define allowed properties for each API endpoint, reject unexpected fields.
- Authorization checks must happen on every request: never skip authentication if ANY valid credential is present—require specific, appropriate credentials.
- Test with low-privilege accounts: attempt to access admin operations, try to modify other users' data, send hidden fields observed in responses.
- Industrial API exposure: Moxa case shows legacy thinking (assuming network isolation) fails when devices expose APIs—implement authentication regardless of network assumptions.
Vendors
Targets
Intelligence Source: Issue 283: AI Security Solutions, Formula 1's API Flaw, Latest OWASP Authorization Incidents | Oct 31, 2025