Payments platform API penetration test uncovers account takeover chain
A grey-box API assessment across 180 endpoints exposed a broken object-level authorisation chain that allowed full merchant account takeover without user interaction.
- Client
- European payments provider processing 4M+ transactions per month
- Duration
- 3 weeks (2 testers) + free retest
- Headline issue
- Merchant account takeover via chained IDOR and weak session rotation
- Sector
- Financial Services
The challenge
The client had grown through acquisition and inherited three separate API gateways with inconsistent authorisation logic. An upcoming PCI DSS assessment required evidence of independent testing across the whole payment path.
Our approach
- Reviewed OpenAPI specifications and inferred undocumented endpoints from mobile and web clients.
- Mapped every endpoint to the roles that should reach it, then tested each role boundary systematically.
- Chained low-severity information disclosure into a working account takeover proof of concept.
- Used AI-assisted analysis to cluster 180 endpoints by authorisation pattern so manual effort focused on outliers.
Outcome
- Critical authorisation chain fixed within 6 days and confirmed closed on retest.
- Authorisation model consolidated behind a single policy service.
- Assessment evidence accepted without follow-up questions by the PCI QSA.
“The report read like an engineering ticket queue, not a scanner dump. That is why the fixes landed in one sprint.”
More case studies
SaaS & Platforms
Multi-tenant isolation review for a B2B SaaS ahead of enterprise onboarding
Authenticated testing across four tenant personas confirmed strong perimeter controls but revealed cross-tenant data leakage through an export job and a background webhook worker.
Healthcare
Internal network assessment for a hospital group with legacy medical systems
A carefully constrained internal assessment achieved domain administrator access in under two days through legacy credential reuse, without disrupting a single clinical system.