A security analyst has noticed a vulnerability in which an attacker took over multiple users' accounts. Which vulnerability did the security analyst encounter?

A security analyst has noticed a vulnerability in which an attacker took over multiple users' accounts. Which vulnerability did the security analyst encounter?

• A. Broken access control
• B. SQL injection
• C. Cross-site scripting
• D. Insecure crypto

Answer: (A)

This scenario tests broken access control. When access controls aren’t properly enforced, an attacker can access or impersonate other users’ accounts because the system fails to validate that every action or data access is allowed for that specific user. Taking over multiple accounts points to authorization checks not being reliably applied, or to horizontal privilege escalation where one user’s session could be used to access other users’ resources. Other flaws would show different signs: SQL injection exploits input to run arbitrary database commands, not inherently about impersonating multiple users; cross-site scripting steals session data by injecting scripts into pages viewed by users; insecure cryptography involves weak or mismanaged encryption, which might expose data but doesn’t directly explain across-many-accounts takeover. So the account-takeover pattern aligns with broken access control. To prevent this, implement strict, server-side authorization checks for every action, enforce least privilege, strengthen session management, and consider multi-factor authentication to reduce the risk of account compromise.

This scenario tests broken access control. When access controls aren’t properly enforced, an attacker can access or impersonate other users’ accounts because the system fails to validate that every action or data access is allowed for that specific user. Taking over multiple accounts points to authorization checks not being reliably applied, or to horizontal privilege escalation where one user’s session could be used to access other users’ resources.

Other flaws would show different signs: SQL injection exploits input to run arbitrary database commands, not inherently about impersonating multiple users; cross-site scripting steals session data by injecting scripts into pages viewed by users; insecure cryptography involves weak or mismanaged encryption, which might expose data but doesn’t directly explain across-many-accounts takeover. So the account-takeover pattern aligns with broken access control.

To prevent this, implement strict, server-side authorization checks for every action, enforce least privilege, strengthen session management, and consider multi-factor authentication to reduce the risk of account compromise.