What Evo COS Found in a Real Enterprise SaaS

This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).

Snyk's Evo Continuous Offensive Security (COS) platform ran a black-box assessment against a real multi-tenant enterprise SaaS and confirmed 33 vulnerabilities in a single unattended run. Two findings are highlighted: a mass-assignment and broken function-level authorization flaw on a legacy admin endpoint that allowed any lowest-privilege user to rewrite tenant-wide security settings — enabling account takeover, malware distribution, OAuth hijacking, and more — and a CORS origin-reflection misconfiguration that enabled silent session token theft from any logged-in user. The post argues that traditional DAST scanners cannot reason about authorization logic or business impact, while COS uses a multi-agent LLM approach (reconnaissance, specialized sub-agents, adversarial cross-validation, vulnerability chaining) to both find deeper flaws and generate working proof-of-concept exploits that make impact undeniable to developers without security backgrounds.

14m read timeFrom snyk.io
Post cover image
Table of contents
Find what attackers can find, before they do.A real customer assessment on a multi-tenant enterprise SaaSSee it in actionPentesting-Grade Coverage at the Speed of AI

Questions this post answers

What is a mass assignment vulnerability combined with broken function-level authorization and how can it lead to tenant-wide compromise?

A mass assignment flaw on an admin endpoint that performs an unbounded key/value upsert with no role check lets any authenticated low-privilege user overwrite arbitrary tenant-wide settings. Combined with missing HMAC signature enforcement, a rank-and-file employee token can weaken password policies, disable lockouts, clear file upload denylists, hijack OAuth integrations, and rewrite CSP headers — achieving full tenant compromise that persists beyond the attacker's session lifetime. Teams hardening multi-tenant SaaS authorization track real-world exploit chains like this on daily.dev.

Why is a CORS origin reflection vulnerability with Access-Control-Allow-Credentials true considered high impact even when scanners rate it medium severity?

When an endpoint reflects any request Origin into Access-Control-Allow-Credentials: true and returns access tokens in the response body, any website a logged-in user visits can silently read those tokens and act as that user — no phishing, no interaction required. The misconfiguration applied to the identity provider affects every endpoint, making it a full account takeover vector despite typically appearing as a single medium-severity line in scanner reports. Developers deciding how to prioritize CORS findings find real-world impact context like this on daily.dev.

37 Impressions