Collected research

AUTHSCOPE: Towards Automatic Discovery of Vulnerable Access Control in Online Services

AUTHSCOPE drives mobile apps automatically, learns which fields of their authenticated API requests carry identity, then substitutes another user's identifiers or tokens and compares the responses to spot servers that hand back data belonging to someone else. It surfaces broken access control across online services at scale without server source code.

Record

Published by

acmccs.github.io

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2016–17 research round

Tags

• idor
• auth-bypass
• rest-api
• android
• dynamic-analysis
• tooling
• info-leak
• large-scale-scan
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of acmccs.github.io, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 12 August 2026.