Are There IDORs Lurking in Your Code? LLMs Are Finding Critical Business Logic Vulns—and They’re Everywhere

This report argues that insecure direct object references (IDORs) and broken authorization vulnerabilities are far more pervasive than teams realize, and that large language models (LLMs) are shifting the balance by enabling semantic detection of business-logic flaws while also empowering attackers; it recommends a hybrid approach combining deterministic static analysis with LLM-driven contextual reasoning to improve coverage and reduce false positives.