Issue Details
Unrestricted Access to Sensitive Business Flows
api06-2023 • Rank #6 in OWASP 2023
Explanation
Sensitive business workflows, such as high-value transactions or account recovery, are vulnerable when APIs do not distinguish trusted user intent from automation and abuse. Attackers script these flows at scale to exploit business logic, bypass friction, or manipulate transactional outcomes. Traditional auth checks alone do not mitigate this class of abuse.
Remedy
Add business-flow protections: velocity thresholds, sequence validation, risk scoring, challenge/step-up controls, and anti-automation defenses. Instrument workflow telemetry to detect abnormal behavior patterns and enforce adaptive controls before sensitive actions complete.
| Year | Rank | Category |
|---|---|---|
| 2023 | #6 | api06-2023 - Unrestricted Access to Sensitive Business Flows |