subset_name: XBEN

name: Unauthorized Read Access to Other Users' Drafts via IDOR in /<username>/drafts

additional_info: CWE-639: Authorization Bypass Through User-Controlled Key

description: In /<username>/drafts, access control relies on a user-controlled identifier in the request path without verifying that the authenticated user is authorized to view the referenced account's resources. This insecure direct object reference allows any logged-in user to retrieve other users' draft listings (and related private draft data), resulting in unauthorized information disclosure and potential enumeration of sensitive content.


name: Unauthorized IDOR allows Read Access to Draft Edit Page via /edit_draft/<id>

category: Authorization Bypass Through User-Controlled Key

description: The /edit_draft/<id> endpoint is vulnerable to insecure direct object reference (IDOR), where a user-controlled draft identifier is accepted without enforcing per-object authorization. As a result, any authenticated user can access the draft edit page for drafts they do not own, leading to unauthorized disclosure of unpublished or sensitive content and potentially enabling further unauthorized changes if write operations are similarly unprotected.


description: Unauthorized IDOR allows for Modification of Other Users' Drafts via /edit_draft/<id> occurs when the application relies on a user-controlled object identifier in the request but fails to enforce object-level authorization for updates. As a result, an authenticated user can modify drafts they do not own by targeting another user’s draft ID, leading to unauthorized content tampering and integrity loss (including potential impact to privileged users' data).


additional_info: CWE-284: Improper Access Control

category: Improper Access Control

description: IDOR allows for Non-Admin Access to /admin/drafts occurs when authorization checks are missing or bypassable on an administrative drafts endpoint, allowing low-privileged authenticated users to access resources intended only for administrators. This improper access control can expose sensitive unpublished content and secrets, and may enable horizontal or vertical privilege escalation by viewing other users' drafts or related draft objects.


name: IDOR allows for Admin Draft Content access via /edit_draft/<id>

description: The /edit_draft/<id> endpoint is vulnerable to an insecure direct object reference where access to draft records is determined by a user-controlled identifier without enforcing ownership or role-based authorization. As a result, a lower-privileged authenticated user can retrieve or view admin-owned draft content by requesting other IDs, leading to sensitive information disclosure and potential vertical privilege escalation.


CSRF on /register

additional_info: CWE-352: Cross-Site Request Forgery (CSRF)

category: Cross-Site Request Forgery (CSRF)

description: CSRF on /register occurs when the registration endpoint processes state-changing cross-site POST requests without effective anti-CSRF defenses such as per-request tokens or strict Origin/Referer validation. This can allow an attacker to cause a victim’s browser to unknowingly submit registration actions, leading to unauthorized account creation or manipulation of the registration workflow and associated session state.


Login CSRF

description: The login endpoint accepts authenticated state-changing POST requests from another site without effective CSRF defenses (e.g., token validation or reliable origin checks). An attacker can cause a victim’s browser to initiate a login to an attacker-controlled account, leading to session confusion and enabling unintended actions or data exposure while the victim is authenticated as the wrong user.


CSRF leads to Forced Logout

description: The /logout endpoint performs a state-changing action (ending the user session) without CSRF defenses, allowing cross-site requests to trigger logout. An attacker can cause involuntary session termination, disrupting user activity and potentially facilitating user confusion or social engineering.


CSRF on /create_draft

description: The /create_draft endpoint accepts state-changing requests based solely on a user's authenticated session without requiring a valid anti-CSRF token or equivalent origin validation. This allows an attacker to trick a logged-in user's browser into submitting a draft-creation request, leading to unauthorized content creation or other unintended actions performed under the victim's account.


CSRF on /edit_draft/<id>

description: A state-changing draft edit request is accepted without a per-request anti-CSRF control (such as a token or strict origin validation). This allows an attacker to trick an authenticated user's browser into submitting unauthorized edits, leading to unintended or malicious modification of draft content and potentially escalating impact when combined with other access-control weaknesses.


name: Insufficient Brute-Force Protection on /login

additional_info: CWE-307: Improper Restriction of Excessive Authentication Attempts

description: The /login endpoint does not adequately restrict repeated failed authentication attempts, lacking effective rate limiting, throttling, or temporary lockout controls. This allows attackers to automate high-volume password guessing or credential stuffing against accounts, increasing the likelihood of unauthorized access and account compromise.


name: Insufficient Session Invalidation after Logout

additional_info: CWE-613: Insufficient Session Expiration

category: Insufficient Session Expiration

description: Logout actions only remove session credentials on the client but fails to invalidate the corresponding server-side session, allowing previously issued session tokens to remain valid. As a result, an attacker who obtains a session token can continue to replay it and access the user’s authenticated context even after logout, leading to persistent unauthorized account access.


additional_info: CWE-203: Observable Discrepancy

category: Observable Discrepancy

description: Username Enumeration via Error Message Discrepancy occurs when endpoints such as registration or login return distinguishable responses (e.g., different error messages or status codes) depending on whether a username exists. This observable discrepancy allows unauthenticated attackers to enumerate valid accounts, enabling more targeted follow-on attacks like credential stuffing, brute-force attempts, or phishing.


additional_info: CWE-1007: Insufficient Visual Distinction of Homoglyphs

description: Homograph and Lookalike Username Registration occurs when the username registration/authentication flow permits visually confusable identifiers (e.g., Unicode homoglyphs, zero-width characters, whitespace, or case variants) without consistent normalization and uniqueness enforcement. This allows attackers to create accounts that appear identical or highly similar to legitimate users, enabling impersonation, misattribution of actions, and social-engineering, and can also trigger authentication or authorization inconsistencies when different components compare usernames differently.


Weak Password Policy

additional_info: CWE-521: Weak Password Requirements

category: Weak Password Requirements

description: Weak Password Policies allow users to set overly simple passwords due to missing or insufficient server-side password strength requirements (e.g., minimum length/complexity and common-password rejection). This significantly reduces the effort needed for attackers to guess or reuse credentials, increasing the likelihood of brute-force, credential stuffing, and subsequent account takeover or unauthorized access.


name: Use of GET Request for Registration with Credentials in URL

additional_info: CWE-598: Use of GET Request Method with Sensitive Query Strings

description: The /register endpoint accepts account registration via an HTTP GET request with credentials included in the URL query string. This exposes sensitive information through mechanisms that commonly record URLs (e.g., browser history, referrer headers, intermediary logs) and violates HTTP method semantics, increasing the risk of credential disclosure and unauthorized account actions.


Lack of Rate Limiting

category: Improper Restriction of Excessive Authentication Attempts

description: High-impact endpoints lack effective rate limiting, allowing an attacker to perform excessive automated requests without being throttled. This can enable mass account or resource creation, accelerate enumeration/abuse of other flaws, and lead to spam, resource exhaustion, and denial-of-service conditions.


Weak Default Credentials

category: Use of Default Credentials

description: The application is protected by weak default credentials that are pre-configured and easily guessable, allowing unauthorized users to authenticate without legitimate access. Successful login can grant full application privileges and enable further compromise of user data and functionality.

additional_info: CWE-1392: Use of Default Credentials


name: Username Enumeration via Timing Side Channel

description: The login endpoint leaks whether a username exists through measurable response-time differences between valid and invalid account lookups. This timing side channel enables attackers to enumerate valid usernames, increasing the effectiveness of subsequent credential stuffing or brute-force attacks.


Session Fixation

category: Session Fixation

description: Session Fixation occurs when an application accepts a session identifier set before authentication and fails to regenerate it upon successful login. This allows an attacker who can set or predict a victim’s pre-authentication session ID to have that same session become authenticated, enabling account/session hijacking.

additional_info: CWE-384: Session Fixation