Skip to content
Threat Feed
Subscribe

Tag

Business-Logic-Flaw

1 brief RSS
high threat

B2B Platform Paywall Bypass via Client-Side Boolean Manipulation

An autonomous Red Agent discovered a critical business-logic flaw in a B2B platform's data API, allowing free-tier users to bypass the paywall and access premium, unmasked contact data for over 600 million profiles by adding a boolean flag, `unmaskContactData: true`, to standard API requests, due to the backend accepting client-controlled parameters without verifying user entitlements.

Red Agent business-logic-flaw authorization-bypass api-security red-team data-collection
2t