Sensitive business workflows, such as high-value transactions or account recovery, are vulnerable when APIs do not distinguish trusted user intent from automation and abuse. Attackers script these flows at scale to exploit business logic, bypass friction, or manipulate transactional outcomes. Traditional auth checks alone do not mitigate this class of abuse.
Add business-flow protections: velocity thresholds, sequence validation, risk scoring, challenge/step-up controls, and anti-automation defenses. Instrument workflow telemetry to detect abnormal behavior patterns and enforce adaptive controls before sensitive actions complete.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2023Latest
#06api06-2023 Unrestricted Access to Sensitive Business Flows
