Find GraphQL API vulnerabilities, with Burp Suite Professional
Summary: PortSwigger added GraphQL checks to Burp Scanner that automatically detect known and hidden GraphQL endpoints, flag when introspection or suggestions are enabled, and report endpoints that fail to validate content type. The scanner also reports when a request can be forged via GET or application/x-www-form-urlencoded POST, which the post ties to CSRF exposure when no token is implemented and SameSite protections can be bypassed or neutralized via the SameSite None flag.
Bottom line: A GraphQL endpoint deployed to production by accident, or one that skips content-type validation, is exactly the kind of asset an attacker finds before you do - and Burp now surfaces both without a tester trawling the site by hand.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026