CWE-408
Incorrect Behavior Order: Early Amplification
The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.
Impactr finds and proves whether CWE-408 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.