API Security Articles
The Latest API Security News, Vulnerabilities & Best Practices
APISecurity.io is a community website for all things related to API security. Our daily news and weekly API Security newsletter cover the latest breaches, vulnerabilities, standards, best practices, regulations, and technology.
API Security Encyclopedia provides details on possible security issues in API contracts and how to remediate them, and our tools help you evaluate how secure the APIs you are working on actually are.
Subscribe to the API Security newsletter
By clicking Subscribe you agree to our Data Policy
From the APISecurity.io Twitter
Researchers @CharlesDardaman and @INIT_3 found API vulnerabilities in #Zipato IoT hubs that allowed to remotely open smartlocks including apartment complexes. These had hardcoded root SSH keys and pass-the-hash vulnerability in APIs: https://t.co/rPusgd0DRL via @blackmarblesh
7-Eleven Japan's payment app #7pay had vulnerable password reset API that allowed attackers to hijack accounts by iterating records. About $510K got stolen from 900 customers in 3 days of the app being on the market. https://t.co/moYiJxCeij report by @mikamiyoh
Developing #REST APIs in @code? #OpenAPI (Swagger) Editor extension makes working with @OpenApiSpec files (#JSON and #YAML, v2 and v3) a breeze. Functionality includes new API templates, navigation, code snippets, IntelliSense, Go to definition, linting. https://t.co/8qGSmiPKqD
API Security weekly newsletter issue 39 is out. Main stories by @JLLeitschuh, @OpenApiSpec / @VisualStudio, @netresec, @CyberInsider /@helpnetsecurity, @alexa99 https://t.co/8rtkmtc7zO
Zoom makes 4+ mln of its Mac users vulnerable to remote attacks by installing a local web server with undocumented API that circumvents browser CORS protection by masking API calls as image retrievals: img or iframe are enough. See @JLLeitschuh's report https://t.co/FA3KZ4Iyd7
API Security Newsletter Archive
- 11 July, 19
- 4 July, 19
- 27 June, 19
- 20 June, 19
- 13 June, 19
- 6 June, 19
- 30 May, 19
- 23 May, 19
- 16 May, 19
- 9 May, 19
From the APISecurity.io Twitter
Researchers @CharlesDardaman and @INIT_3 found API vulnerabilities in #Zipato IoT hubs that allowed to remotely open smartlocks including apartment complexes. These had hardcoded root SSH keys and pass-the-hash vulnerability in APIs: https://t.co/rPusgd0DRL via @blackmarblesh
7-Eleven Japan's payment app #7pay had vulnerable password reset API that allowed attackers to hijack accounts by iterating records. About $510K got stolen from 900 customers in 3 days of the app being on the market. https://t.co/moYiJxCeij report by @mikamiyoh
Developing #REST APIs in @code? #OpenAPI (Swagger) Editor extension makes working with @OpenApiSpec files (#JSON and #YAML, v2 and v3) a breeze. Functionality includes new API templates, navigation, code snippets, IntelliSense, Go to definition, linting. https://t.co/8qGSmiPKqD
API Security weekly newsletter issue 39 is out. Main stories by @JLLeitschuh, @OpenApiSpec / @VisualStudio, @netresec, @CyberInsider /@helpnetsecurity, @alexa99 https://t.co/8rtkmtc7zO
Zoom makes 4+ mln of its Mac users vulnerable to remote attacks by installing a local web server with undocumented API that circumvents browser CORS protection by masking API calls as image retrievals: img or iframe are enough. See @JLLeitschuh's report https://t.co/FA3KZ4Iyd7
