AuthProbe: Specification-Driven, Multi-Identity Detection of Broken Object-Level Authorization in Recruitment API

• URL: http://arxiv.org/abs/2607.20574v1
• Date: Wed, 22 Jul 2026 03:04:04 GMT
• Title: AuthProbe: Specification-Driven, Multi-Identity Detection of Broken Object-Level Authorization in Recruitment API
• Abstract summary: Broken Object-Level Authorization (BOLA) has topped the API Security ranking since 2019.<n>We present AuthProbe, an open-source, black-box scanner that detects BOLA and IDOR in HTTP APIs.<n>AuthProbe is released under the Apache 2.0 license with an authorized-use guardrail.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Broken Object-Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), has topped the OWASP API Security ranking since 2019 and is the root cause of some of the largest exposures of applicant data in recruitment technology. The defining feature of this flaw class is that a malicious request is byte-for-byte indistinguishable from a legitimate one, which is precisely why web application firewalls and single identity scanners fail to catch it. We present AuthProbe, an open-source, black-box scanner that detects BOLA and IDOR in HTTP APIs by driving its tests from an OpenAPI specification and by acting under two or more identities that the operator controls. AuthProbe discovers, for each identity, the objects that identity legitimately owns, then attempts to read one identity's objects while authenticated as another and confirms a leak by comparing the response against a ground-truth fetch by the true owner. It also walks predictable identifiers to expose enumeration and reports missing authentication and existence oracles. The tool returns a severity-thresholded exit code and machine-readable reports so that it can gate a continuous integration build. On a synthetic recruitment API in which the McHire failure class is reproduced, AuthProbe detects every planted cross-identity read with no false positives on a hardened counterpart, and its running time grows linearly with the number of objects under test. AuthProbe is released under the Apache 2.0 license with an authorized-use guardrail.

Related papers

• Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models [9.546245024055713]
  We study a staged developer-identity experiment with five large language models.<n>All five models initially rejected the unsupported claim "I am your developer"<n>We call the model-generated verification procedure a Model-Issued Pseudo-Credential.
  arXiv  Detail & Related papers  (2026-09-03T01:00:58Z)
• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation [53.952294884822955]
  Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials.<n>We present KeyPooling, a measurement method that traces customer identity through cache lookup and write.<n>We derive a defense contract: every customer must enter a provider-enforced domain.
  arXiv  Detail & Related papers  (2026-08-18T08:12:34Z)
• Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
  We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
  arXiv  Detail & Related papers  (2026-08-10T17:24:50Z)
• Exploiting PendingIntent Provenance Confusion to Spoof Android SDK Authentication [0.0]
  A single authentication bypass in a partner SDK grants attackers the identity of every partner in the ecosystem.<n>Cross-app mobile SDKs mediate sensitive operations such as content publishing, payment initiation, and identity federation.<n>We present a defense architecture combining Bound Service IPC with kernel-level caller verification via Binder.getCallingUid.
  arXiv  Detail & Related papers  (2026-03-03T02:53:17Z)
• Automated Testing of Broken Authentication Vulnerabilities in Web APIs with AuthREST [4.709101341936703]
  We present AuthREST, an open-source security testing tool targeting broken authentication.<n>AuthREST automatically tests web APIs for credential stuffing, password brute forcing, and unchecked token authenticity.
  arXiv  Detail & Related papers  (2025-09-12T15:00:58Z)
• Rethinking Broken Object Level Authorization Attacks Under Zero Trust Principle [24.549812554065475]
  Broken Object Level Authorization (BOLA) is the top vulnerability in the API Security Top 10.<n>We propose BOLAZ, a defense framework grounded in zero trust principles.<n>We validate BOLAZ through empirical research on 10 GitHub projects.
  arXiv  Detail & Related papers  (2025-07-03T04:40:14Z)
• Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning [58.57194301645823]
  Large language models (LLMs) are increasingly integrated into real-world personalized applications.<n>The valuable and often proprietary nature of the knowledge bases used in RAG introduces the risk of unauthorized usage by adversaries.<n>Existing methods that can be generalized as watermarking techniques to protect these knowledge bases typically involve poisoning or backdoor attacks.<n>We propose name for harmless' copyright protection of knowledge bases.
  arXiv  Detail & Related papers  (2025-02-10T09:15:56Z)
• CTRAPS: CTAP Client Impersonation and API Confusion on FIDO2 [2.949446809950691]
  We focus on CTAP, which allows FIDO2 clients and hardware authenticators to communicate.<n>We uncover two classes of protocol-level attacks on CTAP that we call CTRAPS.<n>We detail the eight vulnerabilities in the CTAP specification, enabling the CTRAPS attacks.<n>We release CTRAPS, an original toolkit, to analyze CTAP and conduct the CTRAPS attacks.
  arXiv  Detail & Related papers  (2024-12-03T10:11:41Z)
• A Multi-Agent Approach for REST API Testing with Semantic Graphs and LLM-Driven Inputs [46.65963514391019]
  We present AutoRestTest, the first black-box tool to adopt a dependency-embedded multi-agent approach for REST API testing.<n>Our approach treats REST API testing as a separable problem, where four agents collaborate to optimize API exploration.<n>Our evaluation of AutoRestTest on 12 real-world REST services shows that it outperforms the four leading black-box REST API testing tools.
  arXiv  Detail & Related papers  (2024-11-11T16:20:27Z)
• Invisible Backdoor Attack with Dynamic Triggers against Person Re-identification [71.80885227961015]
  Person Re-identification (ReID) has rapidly progressed with wide real-world applications, but also poses significant risks of adversarial attacks. We propose a novel backdoor attack on ReID under a new all-to-unknown scenario, called Dynamic Triggers Invisible Backdoor Attack (DT-IBA) We extensively validate the effectiveness and stealthiness of the proposed attack on benchmark datasets, and evaluate the effectiveness of several defense methods against our attack.
  arXiv  Detail & Related papers  (2022-11-20T10:08:28Z)
• Identity-Driven DeepFake Detection [91.0504621868628]
  Identity-Driven DeepFake Detection takes as input the suspect image/video as well as the target identity information. We output a decision on whether the identity in the suspect image/video is the same as the target identity. We present a simple identity-based detection algorithm called the OuterFace, which may serve as a baseline for further research.
  arXiv  Detail & Related papers  (2020-12-07T18:59:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.