Vietnam Telecom Operator: 14 API Vulnerabilities Remediated Before 5G Launch

A Vietnamese telecommunications operator was launching a 5G consumer self-service platform — a REST API platform with a consumer mobile app, web portal, and third-party developer API. The Ministry of Information and Communications (MIC) requires security testing documentation for major platform launches by licensed telecoms providers.

The platform had been through two internal code reviews during development. However, code review and penetration testing address fundamentally different risk categories. Code review identifies implementation flaws at the source code level; penetration testing identifies vulnerabilities in the running application as an attacker would encounter them — including configuration issues, business logic flaws, and inter-service communication weaknesses that code review cannot detect.

The operator's CISO required external CREST penetration testing with an OWASP API Security Top 10 scope before launch sign-off, with 4 weeks available before the go-live date. The platform's architecture added scope complexity: 3 API versions were maintained simultaneously (v1 for legacy integrations, v2 for the consumer app, and v3 for the third-party developer portal), each with its own authentication and authorisation model.

The 5G platform was expected to serve 2 million subscribers within its first year. The reputational and regulatory risk of launching with undetected API vulnerabilities — particularly in authentication and billing — was unacceptable. A single authentication bypass vulnerability could expose the personal and billing data of every subscriber on the platform.

• 5G consumer platform with 312 API endpoints across 3 API versions
• MIC requires security testing documentation for major telecoms platform launches
• 4-week window before go-live date
• 2 million expected subscribers in first year
• Consumer mobile app, web portal, and third-party developer API all in scope

The three critical vulnerabilities discovered during testing represented the exact category of findings that justify pre-launch penetration testing investment. Each would have been exploitable by a moderately skilled attacker and each had direct impact on subscriber data or financial transactions.

The first critical finding was an authentication bypass on the account management API (v2). By manipulating the JWT token payload and exploiting a signature verification flaw, an attacker could generate a valid session for any subscriber account. This would have allowed access to subscriber personal data, call records, and account management functions for any of the platform's users. The fix required implementing proper JWT signature validation and adding server-side session verification.

The second critical was an Insecure Direct Object Reference (IDOR) vulnerability on the billing API. An authenticated subscriber could modify the account ID parameter in billing API requests to view other subscribers' billing history, payment methods, and outstanding balances. For a telecom operator serving potentially millions of subscribers, this represented a massive data exposure risk.

The third critical involved JWT token lifetime misconfiguration. Access tokens were configured with a 30-day expiry and no refresh token rotation. A stolen token would provide persistent access to a subscriber's account for an entire month without requiring re-authentication. Combined with the authentication bypass vulnerability, this created a scenario where an attacker could maintain persistent access to any subscriber account indefinitely.

The 90-day post-launch period validated the testing investment: zero security incidents were reported against the platform in its first three months of operation with live subscribers. The MIC documentation package was accepted without additional requests, and the operator's security team received the full retest evidence package for their ongoing vulnerability management programme.