How I sped up exploit validation in Repeater using Burp AI

Summary: IT security consultant Adarsh Kumar describes using Burp AI inside Repeater during a time-boxed test of a multi-tenant SaaS platform with a REST API and token-based authentication, asking it to suggest access control tests for GET /api/orders/{orderId}. After sending the AI-generated ID list back into Repeater and tweaking the X-Client-User header it flagged, one request returned another user's invoice details, confirming the IDOR, which Kumar estimates saved him around 20 minutes on that single endpoint.
Bottom line: The bug confirmed here was an IDOR exposing one customer's invoice data to another on a shared API surface, and Kumar notes that without early confirmation he might have moved on and left a high-severity bug in place.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026