API Vulnerabilities
VulnAPI detects a wide range of API vulnerabilities, including those from the OWASP API Security Top 10.
✅ = automated scan available
| Name | OWASP | Severity | Automated Scan |
|---|---|---|---|
| Broken Object Level Authorization (BOLA) | API1:2023 Broken Object Level Authorization | Medium | |
| Private Field Access | API1:2023 Broken Object Level Authorization | Medium | |
| Mass Assignment | API1:2023 Broken Object Level Authorization | Medium | |
| Authentication Bypass | API2:2023 Broken Authentication | High | ✅ |
JWT none algorithm | API2:2023 Broken Authentication | High | ✅ |
| JWT blank secret | API2:2023 Broken Authentication | High | ✅ |
| JWT weak secret | API2:2023 Broken Authentication | High | ✅ |
| JWT Audience cross service relay attack | API2:2023 Broken Authentication | High | |
| JWT Null Signature | API2:2023 Broken Authentication | High | ✅ |
| JWT KID Header Injection | API2:2023 Broken Authentication | High | ✅ |
| JWT Algorithm Confusion | API2:2023 Broken Authentication | High | ✅ |
| JWT Psychic Signature | API2:2023 Broken Authentication | High | ✅ |
| JWT JWK Header Injection | API2:2023 Broken Authentication | High | ✅ |
| JWT JKU Header Injection | API2:2023 Broken Authentication | High | ✅ |
| JWT X5C Header Injection | API2:2023 Broken Authentication | High | ✅ |
| JWT X5U Header Injection | API2:2023 Broken Authentication | High | ✅ |
| JWT Signature not verified | API2:2023 Broken Authentication | High | ✅ |
| JWT Expired | API2:2023 Broken Authentication | High | |
| Discoverable OpenAPI | API7:2023 Server Side Request Forgery | Info | ✅ |
| Discoverable GraphQL Endpoint | API7:2023 Server Side Request Forgery | Info | ✅ |
| GraphQL Introspection Enabled | API8:2023 Security Misconfiguration | Info | ✅ |
| Secrets Leak | API8:2023 Security Misconfiguration | High | |
| Directory Listing | API8:2023 Security Misconfiguration | Medium | |
| Private IP Disclosure | API8:2023 Security Misconfiguration | Low | |
| HTTP Cookies Misconfiguration | API8:2023 Security Misconfiguration | Info | ✅ |
| No CORS Headers | API8:2023 Security Misconfiguration | Info | ✅ |
| Permissive CORS Headers | API8:2023 Security Misconfiguration | Info | ✅ |
| HTTP Method Override Enabled | API8:2023 Security Misconfiguration | Info - High | ✅ |
| X-Content-Type-Options Header Not Set | API8:2023 Security Misconfiguration | Info | ✅ |
| X-Frame-Options Header Not Set | API8:2023 Security Misconfiguration | Info | ✅ |
| CSP Header Not Set | API8:2023 Security Misconfiguration | Info | ✅ |
| CSP Frame Ancestors Not Set | API8:2023 Security Misconfiguration | Info | ✅ |
| HSTS Header Not Set | API8:2023 Security Misconfiguration | Info | ✅ |
| HTTP TRACE/TRACK Methods Enabled | API8:2023 Security Misconfiguration | Info | ✅ |
| Server Signature Leak | API8:2023 Security Misconfiguration | Info | ✅ |
| SSL Certificate Not Trusted | API8:2023 Security Misconfiguration | Medium | |
| SSL Not Enforced | API8:2023 Security Misconfiguration | Medium | |
| Directory Traversal | API10:2023 Unsafe Consumption of APIs | High |
The JWT vulnerability scans are partially powered by the CerberAuth JWTop project.