Santosh Kumar Puppala

Asymmetric Authorization: Finding Access-Control Defects by Comparing Sibling Operations in Open-Source Web Applications

Broken access control is ranked first in the OWASP Top 10:2025, and commodity SAST and DAST scanners cannot verify its correctness. A scanner can tell that a check is missing. It cannot tell whether a check that is present is the right one. This paper describes a practical way to...