GraphQL Security Vulnerabilities in the Wild
summary
A scan of 1,600 endpoints yields 46,000+ security issues (about 30 alerts per app, 10% critical) and ~5,000 exposed PII/tokens, all discoverable without auth. Findings name real attack paths: HTTP-level rate limits bypassed by aliasing + batching (credential brute force and a “GraphQL bomb” file expansion), recursive fragments causing engine-level DoS, and schema reconstruction via field suggestions leading to hidden mutation abuse. Practical mitigations include middleware like GraphQL Armor and a developer security checklist.
AI-written summary · about
chapters (15)
- 0:00Introduction to research
- 1:49Why GraphQL is vulnerable
- 3:19Testing GraphQL APIs securely
- 5:46GraphQL-specific vulnerabilities
- 8:13Common API vulnerabilities in GraphQL
- 8:55Batching and aliasing risks
- 10:41GraphQL bombs explained
- 12:07Recursive fragments DoS
- 13:12Schema introspection leak
- 15:01Sensitive data exposure
- 16:27OWASP Top 10 for GraphQL
- 18:12Study conclusions and report
- 19:17Introducing GraphQL Armor
- 20:00API Security Academy launch
- 21:06Q&A session
related talks
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
32mMind your GraphQL APIs: how to reduce their attack surface
38mEscape Workshop: Discovering GraphQL Vulnerabilities in the Wild
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
32mDecoding GraphQL: How to Map Hidden...
51mAPI Security: Securing GraphQL without going around in circles
37mIs your GraphQL API safe? Let’s find out
29mTop 10 GraphQL Security Checks for Every Developer