--- title: "What Evo COS Found in a Real Enterprise SaaS" url: https://daily.dev/posts/what-evo-cos-found-in-a-real-enterprise-saas-ndzdu6pou source_url: https://snyk.io/blog/what-evo-cos-found-real-enterprise-saas type: article source: "Snyk" published: 2026-08-10T15:39:52.591Z updated: 2026-08-10T15:40:24.861Z tags: ["security", "appsec"] reading_time: 14 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What Evo COS Found in a Real Enterprise SaaS **[Snyk](https://daily.dev/sources/snyk)** · 14 min read · 0 upvotes · 0 comments ## Summary Snyk's Evo Continuous Offensive Security (COS) platform ran a black-box assessment against a real multi-tenant enterprise SaaS and confirmed 33 vulnerabilities in a single unattended run. Two findings are highlighted: a mass-assignment and broken function-level authorization flaw on a legacy admin endpoint that allowed any lowest-privilege user to rewrite tenant-wide security settings — enabling account takeover, malware distribution, OAuth hijacking, and more — and a CORS origin-reflection misconfiguration that enabled silent session token theft from any logged-in user. The post argues that traditional DAST scanners cannot reason about authorization logic or business impact, while COS uses a multi-agent LLM approach (reconnaissance, specialized sub-agents, adversarial cross-validation, vulnerability chaining) to both find deeper flaws and generate working proof-of-concept exploits that make impact undeniable to developers without security backgrounds. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a mass assignment vulnerability combined with broken function-level authorization and how can it lead to tenant-wide compromise? A mass assignment flaw on an admin endpoint that performs an unbounded key/value upsert with no role check lets any authenticated low-privilege user overwrite arbitrary tenant-wide settings. Combined with missing HMAC signature enforcement, a rank-and-file employee token can weaken password policies, disable lockouts, clear file upload denylists, hijack OAuth integrations, and rewrite CSP headers — achieving full tenant compromise that persists beyond the attacker's session lifetime. _Teams hardening multi-tenant SaaS authorization track real-world exploit chains like this on daily.dev._ ### Why is a CORS origin reflection vulnerability with Access-Control-Allow-Credentials true considered high impact even when scanners rate it medium severity? When an endpoint reflects any request Origin into Access-Control-Allow-Credentials: true and returns access tokens in the response body, any website a logged-in user visits can silently read those tokens and act as that user — no phishing, no interaction required. The misconfiguration applied to the identity provider affects every endpoint, making it a full account takeover vector despite typically appearing as a single medium-severity line in scanner reports. _Developers deciding how to prioritize CORS findings find real-world impact context like this on daily.dev._ ## Similar posts on daily.dev - [Evo Continuous Offensive Security Is Here](https://daily.dev/posts/evo-continuous-offensive-security-is-here-drmrfbryz) · Snyk · 1 upvotes · 0 comments - [Continuous Offensive Security & AI Pentesting FAQs](https://daily.dev/posts/continuous-offensive-security-ai-pentesting-faqs-p5xykxwh4) · Snyk · 0 upvotes · 0 comments - [AI is shipping code faster than security was built to handle](https://daily.dev/posts/ai-is-shipping-code-faster-than-security-was-built-to-handle-ik9kidop5) · The New Stack · 0 upvotes · 1 comments - [Snyk Continuous Offensive Security](https://daily.dev/posts/snyk-continuous-offensive-security-aolhgcw1d) · Snyk · 0 upvotes · 0 comments - [CISOs in a Pinch: A Security Analysis of OpenClaw](https://daily.dev/posts/cisos-in-a-pinch-a-security-analysis-of-openclaw-wq3pmvkrr) · Trend Micro · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/what-evo-cos-found-in-a-real-enterprise-saas-ndzdu6pou)