How a Broken GraphQL Password Change Mutation Allowed Account Takeover
Service: Web Application Pentest
Industry: FinTech
Region: Germany
Background
During a security audit of the online banking platform, we analyzed a GraphQL-based API used for user account management. GraphQL is an open-source query language originally developed by Facebook and is widely adopted by financial services companies (e.g. PayPal). Its flexibility lets clients request exactly the data they need, but it also means developers must explicitly enforce access control. In this case, the audit uncovered an insecure direct object reference (IDOR) flaw in the password-change endpoint: the API would change any user’s password if given that user’s userId, without verifying who was making the request. This type of flaw – treating a user’s internal ID as sufficient authority – is a known GraphQL risk.
Severity: High
CVSS Score: 8.8 (CVSS:3.1/AV\:N/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:H/A\:L)
Affected Module: GraphQL API (Password Management)
Exploit Complexity: Moderate
Discovery
We found that the GraphQL mutation changePassword took two inputs: a userId and a new password. Crucially, the server never checked that the requesting user actually owned the given userId. In practice, an attacker with a normal account could reset any other user’s password. The exploit was demonstrated as follows:
Step 1: The attacker logs in as a regular user and obtains a valid authentication token.
Step 2: Using GraphQL introspection or other means, the attacker discovers the changePassword(userId, newPassword) mutation.
Step 3: The attacker determines or guesses a target’s userId (for example, by iterating numeric IDs or querying a user list).
Step 4: The attacker sends the mutation with the victim’s ID. For example:
mutation {
changePassword(input: {userId: "victim-id", newPassword: "NewPass123!"}) {
success
}
}
Since the API did not verify ownership, this request succeeds and the victim’s password is changed to “NewPass123!”.
Step 5: The attacker logs out and logs in as the victim using the new password, confirming the account takeover.
Because the attacker manipulated the userId directly, this is a textbook IDOR. As OWASP notes, permitting viewing or editing someone else’s account simply by supplying its identifier is a broken access control flaw. In our test, the absence of a check on userId meant any account’s password could be changed by an authenticated user.
Technical Root Cause
The root cause was a missing authorization check on the internal object reference (userId). The GraphQL resolver for changePassword assumed that if a valid token was provided, then changing the password was allowed – even for an arbitrary userId. In OWASP Top 10 terms, this is Broken Access Control (A01:2021). Access control should enforce that users cannot act outside their permissions; OWASP explains that failing to do so typically leads to unauthorized data modification or business function abuse. Here the system incorrectly assumed possession of a user ID implied authority. In other words, it broke the rule that “possession of an object’s ID does not grant access to it,” a mistake OWASP labels Broken Object Level Authorization (an IDOR). In summary, the code never verified that the caller was the owner of the account whose userId was supplied.
Real-World Risks
- A. Account Takeover: An attacker can hijack any user’s account by resetting its password.
B. Data Theft: Once inside, the attacker can steal sensitive personal or financial data from the victim’s account. Unchecked IDOR flaws can lead to full data breaches and privacy violations.
C. Privilege Escalation: If the attacker targets a privileged account (e.g. an administrator), they gain its privileges. OWASP explicitly cites cases where broken access control lets an attacker act as admin despite being a normal user.
Recommendations
- Enforce Access Control: Rigorously check permissions on every GraphQL operation. OWASP advises that the server always verify the requester is authorized to view or modify each piece of data. For example, the changePassword resolver should confirm the caller’s userID matches the token.
- Validate Ownership: Before performing sensitive actions (like password changes), explicitly confirm the authenticated user owns the target account. Do not assume a supplied ID implies trust. As OWASP notes, always verify the caller has rights to the object identified by the ID.
- Use Centralized Permission Checks: Implement a single, consistent authorization layer (e.g. middleware or GraphQL resolver logic) to enforce roles and ownership on every mutation and query. The OWASP GraphQL guide recommends using resolvers or RBAC middleware to perform these checks. This ensures no mutation bypasses the same security logic.
- Limit Object Exposure: Where possible, avoid exposing raw internal IDs to clients (use opaque or random identifiers). Also disable any GraphQL introspection in production or restrict sensitive fields. Failing to expose IDs greatly reduces the attack surface for IDOR.
Conclusion
This case underscores that internal object references must always be protected, especially in GraphQL APIs. A flexible query language can inadvertently expose IDs, but possession of an ID should never bypass authorization. OWASP explicitly warns that simply providing an ID without verifying access is a broken-object-level authorization (IDOR) bug. In practice, every GraphQL account or password mutation must check that the requester is the account owner. Enforcing such access controls and ownership validation is essential to prevent exactly this form of account takeover.
All identifiers, domains, and user data in this case study have been anonymized to preserve client confidentiality.
Other Services
Insomnia Security Scanner
AI-powered web application security scanner by CQR. Automated vulnerability discovery, exploit verification, and detailed reporting for modern applications.
Learn more
Infrastructure Protection by CRYEYE
Security audits via CryEye provide enterprise information security, protecting the entire infrastructure.
Learn more Penetration Testing
Find vulnerabilities across your entire business infrastructure before hackers do! At penetration testing consulting, we will select pentest methods and other custom cybersecurity recommendations for your business.
Learn more Social Engineering
Simulate real-world phishing, vishing, and pretexting attacks to measure and improve your team's security awareness and response capabilities.
Learn more Performance Testing
All kinds of load and performance testing of your system from the CQR online security company.
Learn more AI-Powered Vulnerability Assessment
Leverage artificial intelligence to discover, prioritize, and remediate vulnerabilities across your digital assets faster and more accurately than traditional scanners.
Learn more Cloud Security Audit (AWS / GCP / Azure)
Comprehensive security review of your cloud environments — IAM policies, network controls, data exposure, and misconfigurations across all major cloud platforms.
Learn more DevSecOps Integration
Embed security into every stage of your CI/CD pipeline. Automated SAST, DAST, SCA, and secret scanning so vulnerabilities are caught before they reach production.
Learn more API Security Testing
In-depth testing of REST, GraphQL, and SOAP APIs for authentication flaws, authorization bypasses, injection vulnerabilities, and data leakage risks.
Learn more Mobile Application Penetration Testing
Manual and automated security testing for iOS and Android applications — reverse engineering, runtime analysis, traffic interception, and backend API assessment.
Learn more IoT Security Assessment
Evaluate firmware, communication protocols, cloud backends, and physical interfaces of IoT devices to identify vulnerabilities before attackers do.
Learn more Blockchain & Smart Contract Audit
Formal verification and manual code review of smart contracts on Ethereum, Solana, and other chains. Detect reentrancy, overflow, and logic flaws before deployment.
Learn more Red Team Operations
Advanced adversary simulation using real attacker TTPs (MITRE ATT&CK) to test your detection, response, and overall security posture under realistic conditions.
Learn more Threat Intelligence & Monitoring
Continuous monitoring of threat feeds, dark web, and attacker infrastructure to provide actionable intelligence specific to your organization and industry.
Learn more Zero Trust Architecture Review
Assess and design your Zero Trust security model — identity verification, micro-segmentation, least-privilege access, and continuous validation controls.
Learn more Compliance Consulting (PCI DSS / SOC 2 / GDPR)
Expert guidance to achieve and maintain compliance with major security frameworks. Gap analysis, remediation roadmaps, and audit-readiness support.
Learn more Dark Web Monitoring
Continuous surveillance of dark web forums, marketplaces, and breach databases for leaked credentials, sensitive data, or mentions of your organization.
Learn more Phishing Simulation & Awareness Training
Controlled phishing campaigns combined with interactive security awareness training to build a human firewall across your entire organization.
Learn more Supply Chain Security Audit
Assess third-party vendor risks, open-source dependencies, and software supply chain integrity to prevent attacks like SolarWinds and Log4Shell.
Learn more Container & Kubernetes Security
Security review of Docker images, Kubernetes clusters, RBAC policies, network policies, and runtime configurations to harden your container infrastructure.
Learn more Web Application Firewall (WAF) Deployment
Professional WAF setup, rule tuning, and ongoing management to block SQL injection, XSS, CSRF, and other OWASP Top 10 threats in real time.
Learn more Bug Bounty Program Management
Full lifecycle management of your bug bounty program — scope definition, researcher coordination, triage, validation, and remediation tracking.
Learn more OSINT Investigation Services
Open-source intelligence gathering on individuals, organizations, and infrastructure. Ideal for pre-engagement recon, fraud investigation, and competitive analysis.
Learn more Digital Forensics & Incident Response
Rapid response to security breaches — evidence collection, malware analysis, attacker timeline reconstruction, and actionable remediation recommendations.
Learn more