A global insurance provider with over 8 million customer records had two critical misconfigurations that, when combined, granted an attacker full backend access without any credentials.
Flaw 1
Hard-coded AWS Cognito credentials embedded in a publicly accessible JavaScript file. These credentials were discoverable by anyone who inspected the client-side code.
Flaw 2
APIs that trusted any valid OAuth token without verifying the user's role or permissions. This meant that an attacker who obtained credentials from the JavaScript file could immediately authenticate and interact with backend APIs as if they were a privileged user.
Combined impact
Full backend access to systems containing 8 million+ customer records, including personally identifiable information (PII) and health data. This represented significant GDPR and HIPAA regulatory exposure in addition to the direct security risk.
This case illustrates why a validation-first CTEM approach is necessary. Traditional vulnerability scanners would likely have flagged each flaw independently, but the chained exploitability — the real-world impact — would only be revealed through adversarial validation that tests how misconfigurations interact.
ULTRA RED's platform discovers exposed credentials in client-side code and validates API authorization flaws as part of its continuous external attack surface scanning, providing the proof-of-exploit evidence needed to prioritize and remediate findings like these before attackers can exploit them.
