The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
Part 2: How the Red Agent bypassed backend resolvers to expose an entire airline booking database in fifteen minutes
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.