Auth and sessions
Registration or verification endpoint usable without prerequisites
An endpoint in the sign-up or verification flow accepts calls out of order, so an account can be created or verified without the intended step.
TermsAPI (the interface other software calls; tested directly, without the UI in between) · cross-site request forgery (another site making a user's browser send a state-changing request with the user's cookies) · cross-site scripting (user-typed text rendered as markup, so a script in a name or comment runs in other users' browsers) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
The Base44 case: register and verify-otp endpoints accepted unauthenticated calls, and app ids were public, so anyone could create a verified account on private applications. Flow-order rules live in the product, not in the code sample.
Two authentication endpoints (register and verify-otp) on a prompt-to-app platform accepted requests without authentication; because app ids were visible in manifests, anyone could register a verified account on private enterprise applications. Reported 9 July 2025, fixed within 24 hours.
Source: Wiz Research, 2025-07-29 · verified 2026-09-21
How we detect it
Replay each auth endpoint out of sequence with ids taken from public manifests.
Checklist items that catch it
Auth endpoints cannot be used out of order
manual Call register, verify, reset and invite endpoints out of sequence and with ids or tokens taken from public files.
No endpoint creates a verified account or resets a credential without the intended prior step.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.