Hardcoded Bearer Token in Client-Side JavaScript Enables Critical Broken Access Control (All Chats Exposed)

Hello mates,

In this write-up, I’ll show you how a quick search in Burp Suite led me to a hardcoded Bearer token hiding in plain sight inside a JavaScript file, and how that single token gave me unrestricted access to every single chat on the platform.

No complex exploits. No fancy payloads. Just a simple mistake with massive consequences.

Let’s get into it.

Step 1: Initial Request
I started by sending a GET request to /api/v1/chats/{chat_id} to view my own chat data. The server responded with a 200 OK and returned my chat details in JSON format, everything looked normal.

Step 2: Testing for IDOR
Next, I attempted to access another user’s chat by changing the chat_id in the URL to a different UUID:

GET /api/v1/chats/019dd334-b749-70e6-89f0-6dec21c268a6

The server returned a 403 Forbidden with:

{ "detail": "Access denied" }
// This indicated that IDOR was not possible at this endpoint.

Step 3: Testing for Broken Access Control (BAC)
I then tried to retrieve all chats by sending a GET request to /api/v1/chats (without a specific ID). Once again, I received a 403 Forbidden.

Get Hamed Elnwasani’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

At this point, the endpoint appeared to be properly restricted.

Step 4: Searching for Credentials
Using Burp Suite’s Search, I looked for common authentication keywords like:

• token
• bearer
• apikey
• authorization
• jwt
• etc.

That’s when I found something interesting, a hardcoded Bearer token inside a JavaScript file loaded by the application.

Step 5: Exploiting with the Found Token
I copied the discovered Bearer token and used it in the Authorization header of a new request:

GET /api/v1/chats
Host: domain.ai
Authorization: Bearer <exposed_token>

This time, the server returned a 200 OK and disclosed all chat records, including those belonging to other users.

Impact

This was a critical Broken Access Control (BAC) vulnerability that allowed me to:

• View all chat conversations from every user
• Access sensitive information shared in those chats
• Potentially pivot to other endpoints using the same token

Thanks For reading, I hope you enjoyed it.