“Any attacker could simply send an HTTP request and extract confidential data without any authentication barriers,” CloudSEK researchers shared with Cyber Security News. CloudSEK’s BeVigil security platform discovered that a prominent technology service provider left critical API endpoints completely unprotected, allowing unrestricted access to confidential employee data without any authentication mechanisms in place. Organizations must adopt proactive API security postures to prevent similar vulnerabilities, as the consequences of exposed endpoints can lead to data breaches, regulatory penalties, and significant reputational damage. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. These vulnerable endpoints were configured without proper OAuth 2.0 authentication or API key validation, creating a significant security gap in the company’s infrastructure. Security researchers have identified a sophisticated malware campaign utilizing Agent Tesla variants delivered through elaborate multi-stage attack sequences.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 17 Apr 2025 10:55:06 +0000