What Evo COS Found in a Real Enterprise SaaS
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Snyk's Evo Continuous Offensive Security (COS) platform ran a black-box assessment against a real multi-tenant enterprise SaaS and confirmed 33 vulnerabilities in a single unattended run. Two findings are highlighted: a mass-assignment and broken function-level authorization flaw on a legacy admin endpoint that allowed any lowest-privilege user to rewrite tenant-wide security settings — enabling account takeover, malware distribution, OAuth hijacking, and more — and a CORS origin-reflection misconfiguration that enabled silent session token theft from any logged-in user. The post argues that traditional DAST scanners cannot reason about authorization logic or business impact, while COS uses a multi-agent LLM approach (reconnaissance, specialized sub-agents, adversarial cross-validation, vulnerability chaining) to both find deeper flaws and generate working proof-of-concept exploits that make impact undeniable to developers without security backgrounds.
Table of contents
Find what attackers can find, before they do.A real customer assessment on a multi-tenant enterprise SaaSSee it in actionPentesting-Grade Coverage at the Speed of AIQuestions this post answers
What is a mass assignment vulnerability combined with broken function-level authorization and how can it lead to tenant-wide compromise?
A mass assignment flaw on an admin endpoint that performs an unbounded key/value upsert with no role check lets any authenticated low-privilege user overwrite arbitrary tenant-wide settings. Combined with missing HMAC signature enforcement, a rank-and-file employee token can weaken password policies, disable lockouts, clear file upload denylists, hijack OAuth integrations, and rewrite CSP headers — achieving full tenant compromise that persists beyond the attacker's session lifetime. Teams hardening multi-tenant SaaS authorization track real-world exploit chains like this on daily.dev.
Why is a CORS origin reflection vulnerability with Access-Control-Allow-Credentials true considered high impact even when scanners rate it medium severity?
When an endpoint reflects any request Origin into Access-Control-Allow-Credentials: true and returns access tokens in the response body, any website a logged-in user visits can silently read those tokens and act as that user — no phishing, no interaction required. The misconfiguration applied to the identity provider affects every endpoint, making it a full account takeover vector despite typically appearing as a single medium-severity line in scanner reports. Developers deciding how to prioritize CORS findings find real-world impact context like this on daily.dev.