API Abuse … see somebody else's invoice, if they can call an endpoint the frontend never displays, or if there is no limit on the number of requests, the API becomes open …

Authentication Bypass … a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.

Denial of Service / DoS One endpoint triggers a heavy database operation, so a small number of requests consumes all the processing capacity.

Distributed Denial of Service / DDoS … its the network layer and the application's login endpoint at the same time, so protection at one layer is not enough.

Resource Exhaustion … atabase, on memory, on the thread pool, or on one endpoint that costs too much.

SSRF … nvironments. If the server can reach the metadata endpoint, the attacker can try to extract temporary credentials and move from one hole in an application to a …