Open Sesame: The Cave That Checked the Password but Not the Thief
Ali Baba’s cave opened for anyone who spoke the phrase. It never asked who was speaking, or what they were allowed to carry out. That is broken object-level authorization — and it has topped the OWASP API list for years.