The 5 Vulnerability Classes That Appear in Almost Every B2B SaaS Pentest

1. Broken Object Level Authorization (BOLA/IDOR) An authenticated user can access or modify resources belonging to other users by manipulating object identifiers in API requests. Multi-tenant SaaS applications share infrastructure across customers. If your API checks authentication but not authorization at the object level, one customer can read another customer's data by changing an ID. We find this in direct object references in REST endpoints, GraphQL queries that accept tenant-crossing IDs, and batch endpoints that skip per-item authorization checks. Fix: Implement object-level authorization in the data access layer. Verify that the requesting user's organization owns the requested resource before returning any data. 2. Broken Authentication — JWT Implementation Errors Flaws in how JSON Web Tokens are created, validated, or managed. Common patterns: algorithm confusion (RS256 to HS256 downgrade), missing expiration validation, weak signing secrets, and tokens that survive logout. J