What are common API security vulnerabilities?

The route nobody gated

Real breaches rarely come from weak cryptography, but usually from a missed check. This request carries a token for the user role, and TLS protects the request on the wire. The request is validated against a few checks : authentication and the route role first. The object owner and the field scope come next, and these checks combined secure the endpoint.
TLS protects the request while it travels. The request passes all four checks and server responds with a 200. A breach is usually a missed check on the request.
Authentication only says who the caller is. All three routes pass that check. But GET /admin/users needs a role check too, and it is missing.
The same token carries the user role, but the admin route never checks it. The server returns 200 with 1,204 email addresses, no exploit needed. OWASP calls this broken function level authorization, API5.
The endpoint GET /users/124/orders checks authentication and role, but not ownership. The role check passes any normal user, so any other user can read user 124's orders. That missing check is broken object level authorization, OWASP API1.
A default-deny policy fixes the function level gap. Every route stays closed unless it is listed as open. So a route nobody remembered is a route nobody can reach.

The model is not the API

The user model holds six columns: id, name, email, password_hash, role and internal_notes. Three of those are safe to show. The other three are meant to be private for the system.
The handler for GET /users/123 returns the whole model, all six values, including password_hash and internal_notes. The client may never display them, but anyone who opens the network tab can read them.
The response DTO carries id, name, and email, so only those three reach the client. A DTO, a data transfer object, is the API's shape, separate from the database table. Filter on the server, not the client.
A POST /users request carries name and email. The handler calls User.create(req.body), which binds it onto the model and returns 201. Returning the whole user is the same convenience in reverse.
The request body now sets role to admin. No code checked that field, and the model accepts anything matching a column, so it created an admin account. That is mass assignment.
The server now has an allow list: name and email. A new signup arrives, and the server accept both email and mane and ignores role because role is not on the allow list. So the user is created with the default role. List what is allowed to be written. A deny list of dangerous fields can miss the next column you add.
The API returns more fields than the caller needs, and accepts more than it should. OWASP merged excessive data exposure and mass assignment into one, API3:2023, broken object property level authorization. The model is not the API.

Guardrails are the third family

Nothing limits one client's traffic, so the rate hits 2400 req/s and p99 latency reaches 9.8 seconds. Unrestricted resource consumption, OWASP-API4, is a cost and an outage before it is ever a hack.
A rate limiter rejects anything above 1000 requests a second and returns 429. The limit is about capacity and fairness between callers.
The service parses the whole request body before any handler runs. A 10 MB string and a nested array reach the parser first, so the parser can be attacked too. A schema closes that gap, so the service rejects the next oversized body with a 400. Check shape, size and type on the way in, every field, every time.
A normal user calls GET /admin/users and the server answers 200. The service log records nothing, so nobody will ever know about that call. Log every request: the time, the user, the method, the path and the status. Logging turns a breach into an incident you can investigate, so log who called what. But don't log the secrets the caller sent.
A scanner sends requests to the service. The path /beta answers 404, /v2 answers 200, and the deprecated /v1 still answers 200. Nobody documented /v1 for two years, and the service never stopped running it. Improper inventory, OWASP-API9: hiding an endpoint does not secure it, and forgetting an endpoint does not remove it.
A Sunset header on the /v1 route indicates the route's last day, 31 Dec 2026. Retiring means ending a version without breaking the clients that still use that version.

What are common API security vulnerabilities?

API security: three families of mistakes, not a top ten list

74 of 92 API Design answers are in Pro.