some of the worst API security i've EVER seen

The McDonald's India MCD Delivery app contains critical security flaws enabling unauthorized access, order manipulation, and data exfiltration, including access to driver details and user orders via broken authorization and JWT validation. 0:07

Key Takeaways:
• Broken object-level authorization allows access to any order by manipulating order IDs, enabling viewing, tracking, and theft of others' orders 3:45.
• A guest JWT token is used without backend validation, permitting unauthorized access to order and driver data 6:45.
• A backdoor user creation API allows account creation without verification, granting full system access 11:31.
• A time-of-check/time-of-use vulnerability enables redirecting in-progress orders to different addresses, posing fraud risks 22:01.
• The admin panel can be accessed with a consumer JWT token, exposing sensitive KPIs and driver data 23:47.

The researcher exploited these flaws to order food for one cent and redirect deliveries, demonstrating severe privacy and financial risks—yet the report was resolved within 90 days with a $240 Amazon gift card awarded. 26:16

Sources:

• 0:07 Discussion of API flaws and user data exposure in MCD Delivery.
• 3:45 Discovery of broken object-level authorization in order tracking.
• 6:45 JWT token misuse without backend validation.
• 11:31 Backdoor user creation API enabling unverified account acc