PTKDMobile App Security
Knowledge base / PTKD-API-UNAUTH-MUTATION
medium M3 MASVS-AUTH-1 dynamic analysis PTKD-API-UNAUTH-MUTATION

State-changing request succeeded without authentication

A first-party POST/PUT/PATCH/DELETE returned a 2xx with no Authorization or session cookie present, suggesting the endpoint may not enforce authentication (a broken-access-control smell worth an authorized active test).

How it's exploited

A first-party state-changing request (POST/PUT/PATCH/DELETE) returned success with no Authorization header or session cookie present. If the endpoint does not enforce authentication, anyone can invoke it directly; this is a strong lead for a broken-access-control test.

Why it matters

Unauthenticated data modification or deletion, and often broken object-level authorization (IDOR) on the same endpoints.

How to fix it

  1. Require authentication and authorization on every state-changing endpoint.
  2. Verify the caller owns the object being modified (object-level access control), and run an authorized active test against these endpoints.

References