I Changed One “User_Id” and the API Said “Sure” — From Password Reset to Mass Account Takeover

Account takeover vulnerabilities are among the most impactful findings in web and API security assessments. Sometimes they involve complex authentication bypasses, token manipulation, or sophisticated exploit chains. Other times, the vulnerability comes down to one fundamental mistake: the backend trusts the client to tell it whose password should...