BOLA IDOR account_id change is a threat to banking apps
Question asked:
“Broken Object-Level Authorization (BOLA/IDOR) where a logged-in user changes the account_id parameter in the dashboard API request to fetch another customer's balance and transaction history is an accurate potential threat against an online banking app with operations such as login, account dashboard, funds transfer, and bill pay.”
Summary
Broken Object-Level Authorization (BOLA), also known as IDOR, is a well‑known vulnerability where an authenticated user can alter an object identifier such as account_id in an API request and retrieve another user’s balance or transaction history. This pattern is documented as a realistic threat in banking applications and is recognized by security authorities as a critical access‑control issue.
Sources 56 searched
- Insecure Direct Object Reference (IDOR) | OWASP Foundation
Using UUIDs (v4) or other random identifiers mitigates this information disclosure. Note that hashing a sequential value (e.g., MD5(123)) does not help — an attacker can precompute hashes for the entire input space. However, non-guessable identifiers alone do not prevent IDOR — proper authorization checks are the primary defense.
- What is an example of a real bug bounty report where IDOR was used to exploit a banking application? - Web Asha Technologies
Yes, IDOR remains a common and critical bug. Many APIs, especially mobile ones, still lack proper object-level authorization checks, making them vulnerable. Yes, but in most real-world scenarios like banking apps, IDOR is found in authenticated ...
- What Is IDOR? Insecure Direct Object Reference Explained | Wiz
According to MITRE's CWE-639, the weakness is "Authorization Bypass Through User-Controlled Key," which describes exactly this pattern of trusting a client-supplied reference. OWASP places it under Broken Access Control, the category that topped its 2021 Top 10 list. Build the server-side authorization habits that stop IDOR at the source with a practical secure coding checklist. Picture a banking app that shows your statement at a URL like /account?id=1001.
- BOLA: The API Vulnerability Hiding in Plain Sight | Snyk
BOLA, introduced through the OWASP ... manipulable reference, BOLA reframes the issue as what it truly is: a broken authorization check at the object level....
- BOLA vs BFLA: Differences, Attack Patterns & Testing Guide for API Security Teams
This pattern has appeared in real-world incidents. In the 2024 Spoutible breach, authenticated API requests exposed other users’ sensitive data because object-level authorization checks were missing.
- What is IDOR and BOLA? Vulnerability Guide | Unihackers
Insecure Direct Object Reference ... are access control vulnerabilities where an application exposes internal object references, such as user IDs or file names, and fails to verify that the requesting user has permission to access the referenced object...
- Unraveling Vulnerabilities: Understanding the difference between IDOR, BAC and BOLA | by Mateus Pantoja | Medium
To talk about this topic, we’ll start with an introduction to OWASP (Open Worldwide Application Security Project), focusing specifically on the 10 most critical vulnerabilities in the web scenario. We will then explore BAC (Broken Access Control), including concepts and examples of IDOR (Insecure Direct Object References) and BOLA (Broken Object Level Authorization).
- What Is IDOR / BOLA? (Broken Object Level Authorization)
IDOR (Insecure Direct Object Reference) — known as BOLA (Broken Object Level Authorization) in APIs — is the flaw where an app uses an identifier from the request to fetch an object without checking the user is allowed to see it.
- What Is BOLA (IDOR) Vulnerability? | Ubserve
Yes in practice. IDOR (Insecure Direct Object Reference) is the older, OWASP Top 10 2017-era name; BOLA (Broken Object Level Authorization) is the modern API-security term used in the OWASP API Security Top 10.
This fact check is free and donation-based. $1 powers ~30 fact-checks.
