Topic starter
20/08/2026 6:10 pm
TL;DR: Access control flaws, API leakage, and XSS remained high-impact failure points in 2024 software security, with examples ranging from IDOR-style resource abuse to exposed password reset tokens and admin session hijacking, according to INTIGRITI. The practical lesson is that software security still breaks at the intersection of identity, permissions, and exposed attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by INTIGRITI: “Software industry: Top vulnerabilities in 2024 and what to watch for in 2025”.
Key questions
Q: What breaks when finance applications have weak object-level authorization?
A: Attackers can change an identifier or request parameter and retrieve another user’s data, transaction history, or account details.
A: APIs are often the real control plane behind mobile and web applications.
Q: What are the signs that XSS is becoming a high-severity issue?
A: XSS becomes high severity when attacker-controlled content can run inside authenticated workflows used by administrators or support staff.
Practitioner guidance
- Enforce object-level authorization everywhere Check every sensitive request on the server side against the current user, tenant and action.
- Minimize API response payloads Return only the fields required for the current operation and suppress reset tokens, session material and internal identifiers from all client-facing responses.
- Test privileged workflows for XSS Prioritize support tools, admin consoles and employee-facing forms where injected content could execute inside an authenticated high-privilege session.
Bottom line: The biggest software security failures in 2024 were not exotic exploits but simple control breaks in authorization, API design and browser trust.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:46 pm
Access control failures are still the most dangerous software weakness because they collapse identity and authorization into a single exploit path. IDOR-style bugs matter because they bypass the intended relationship between user, role and object. Once the application stops checking ownership or tenant boundary on the server side, least privilege becomes a paper control. Practitioners should treat object-level authorization as a core governance control, not a code-quality checkbox.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should security teams rely on both scanners and bug bounty?
A: Yes. Scanners provide routine coverage for known weakness classes, while bug bounty gives independent adversarial validation against novel paths and human abuse patterns. The two are complementary because they answer different questions: what is known to be exposed, and what a determined attacker can still make work.
👉 Read our full editorial: Software vulnerabilities in 2024 exposed RBAC, API, and XSS gaps