Omar Tsai | Searcharxiv

arXiv2026

GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing

GraphQL APIs power production systems across financial services, e-commerce, and social platforms, yet their most critical access-control vulnerabilities--Insecure Direct Object Reference (IDOR), Use-After-Free (UAF), and state-dependent injection--routinely escape automated security testing. Industry-standard scanners (ZAP) and the leading research fuzzer (EvoMaster) test operations in isolation and cannot compose the multi-step sequences these flaws require. We present GraphQLer, an open-source automated security testing framework built for production GraphQL APIs. GraphQLer constructs a typed dependency graph from live schema introspection and synthesizes vulnerability chains--ordered operation sequences targeting specific flaw classes. Three strategies cover the critical attack surface: topological SCC-traversal for general reachability, cross-user IDOR replay for broken access control, and CREATE -> DELETE -> READ synthesis for UAF. On a production financial API (FinServ), GraphQLer identified eight potential vulnerabilities--including denial-of-service vectors that exposed stack traces and sensitive implementation details--without prior documentation or authentication credentials. On a self-hosted Saleor instance pinned to the CVE-2022-39275 commit, GraphQLer reproduced all four broken-access-control mutations cited in the security advisory. On the 11 public APIs of the coverage set, GraphQLer achieves 85.52% mean PositiveCoverage versus 29.29% (EvoMaster) and 21.80% (ZAP); across the 21 evaluated APIs it detects all 5 confirmed IDOR endpoints, UAF behavior on two controlled schemas, and confirms XSS and SQLi on DVGA (an independent third-party oracle)--while all baselines detect zero chain-based vulnerabilities.

cs.CR↗

arXiv2025

PrediQL: Automated Testing of GraphQL APIs with LLMs

GraphQL's flexible query model and nested data dependencies expose APIs to complex, context-dependent vulnerabilities that are difficult to uncover using conventional testing tools. Existing fuzzers either rely on random payload generation or rigid mutation heuristics, failing to adapt to the dynamic structures of GraphQL schemas and responses. We present PrediQL, the first retrieval-augmented, LLM-guided fuzzer for GraphQL APIs. PrediQL combines large language model reasoning with adaptive feedback loops to generate semantically valid and diverse queries. It models the choice of fuzzing strategy as a multi-armed bandit problem, balancing exploration of new query structures with exploitation of past successes. To enhance efficiency, PrediQL retrieves and reuses execution traces, schema fragments, and prior errors, enabling self-correction and progressive learning across test iterations. Beyond input generation, PrediQL integrates a context-aware vulnerability detector that uses LLM reasoning to analyze responses, interpreting data values, error messages, and status codes to identify issues such as injection flaws, access-control bypasses, and information disclosure. Our evaluation across open-source and benchmark GraphQL APIs shows that PrediQL achieves significantly higher coverage and vulnerability discovery rates compared to state-of-the-art baselines. These results demonstrate that combining retrieval-augmented reasoning with adaptive fuzzing can transform API security testing from reactive enumeration to intelligent exploration.

cs.CR↗