Title
Post-auth server-side API BOLA via Next.js routes
Target
kurs.onecode.de/api/*, /v1/*
Class
IDOR
Confidence
62/100
Reasoning
Next.js/Turbopack App Router with registered /api + /v1 routers confirmed (auth-gated at 307). Course platform semantics predict API endpoints for enrollment data, course content, user profiles. If server-side route handlers don't enforce tenant isolation (relying on client-side filtering), cross-tenant data access is possible via parameter manipulation.
Evidence needed
Authenticated session; fuzz /api/* and /v1/* routes with parameter variations (id, user_id, course_id); observe response bodies for cross-tenant data.
Verify steps
- Obtain authenticated session. 2) Enumerate /api/* routes (Next.js RSC flight data, bundle analysis). 3) Test each endpoint with valid + invalid tenant IDs. 4) Compare response data across two accounts.
Impact
Cross-tenant data access — HIGH to CRITICAL depending on data sensitivity.
Testability
AUTH_HELPED
model: bigpickle · auto-synced from leads/lead-*.md
Title
Post-auth server-side API BOLA via Next.js routes
Target
kurs.onecode.de/api/*, /v1/*Class
IDOR
Confidence
62/100
Reasoning
Next.js/Turbopack App Router with registered /api + /v1 routers confirmed (auth-gated at 307). Course platform semantics predict API endpoints for enrollment data, course content, user profiles. If server-side route handlers don't enforce tenant isolation (relying on client-side filtering), cross-tenant data access is possible via parameter manipulation.
Evidence needed
Authenticated session; fuzz /api/* and /v1/* routes with parameter variations (id, user_id, course_id); observe response bodies for cross-tenant data.
Verify steps
Impact
Cross-tenant data access — HIGH to CRITICAL depending on data sensitivity.
Testability
AUTH_HELPED
model: bigpickle · auto-synced from leads/lead-*.md