nock
op/jbellsign out
phase
reporting
rate
20/s
window ends
2026-09-25
status
closed

The report lists every finding that isn't marked junk, ordered by severity. Export it as Markdown to edit or convert.

Globex: web application penetration test

globex-api · 2026-09-14 to 2026-09-25

Scope

  • api.globex.testin scope

Summary

  • critical0
  • high1
  • medium1
  • low0
  • info0

Findings

  1. F-001highCWE-613fixed

    API keys accepted after revocation

    * api.globex.test

    Revoked API keys keep working for up to 24 hours because of a cache in front of key validation.

    Remediation. Invalidate the cache entry when a key is revoked.

  2. F-002mediumCWE-307fixed

    No rate limit on token endpoint

    POST /oauth/token

    The token endpoint accepts unlimited client credential attempts.

    Remediation. Throttle by client id and source address.