Question

A security tester reviewing a company's REST API discovers that changing the numeric account ID in the URL path /api/v1/accounts/1042/statements to /api/v1/accounts/1043/statements returns another customer's statements. The request carried a valid, authenticated bearer token belonging to the tester. Which underlying flaw most accurately describes this finding, and what is the correct remediation?

Accepted Answer

Broken object-level authorization; enforce server-side checks that the authenticated principal owns or is permitted to access the requested object for every request

Answer

Broken authentication; require multi-factor authentication before issuing bearer tokens to API clients

Answer

Injection; apply parameterized queries and input validation on the account ID field

Answer

Security misconfiguration; disable verbose error messages and enable TLS on the API endpoint