This article examines how well AI models Claude Code and OpenAI Codex can identify Insecure Direct Object Reference (IDOR) vulnerabilities in real-world applications. It reveals that while these models excel in simpler cases, they struggle with more complex authorization logic, leading to a high rate of false positives.

The article explores the critical web vulnerability known as Insecure Direct Object References (IDOR), a common issue in access control that allows unauthorized users to access or modify data by manipulating identifiers in URLs and requests. It emphasizes the importance of proper access control mechanisms, outlines various types of access control flaws, and provides practical strategies for identifying and exploiting these vulnerabilities during bug bounty hunting.