Die Session

Broken Access Control: Why BOLA, BOPLA, and BFLA Remain the Biggest Risks in 2026

The OWASP Top 10 was newly released in 2025 – and once again, Broken Access Control takes first place. This talk examines three critical vulnerabilities: BOLA (Broken Object Level Authorization), BOPLA (Broken Object Property Level Authorization), and BFLA (Broken Function Level Authorization).

Why are these among the most common security flaws? And how can we systematically protect against them? Using concrete code examples, this presentation demonstrates how effective authorization works and how the attack surface can be drastically reduced with the right design patterns.