Sprocket Pentest Finds Cross-Tenant Exposure in Bank Mortgage Portal

Summary

A Sprocket Security-sponsored article describes an unauthenticated API on a bank-branded mortgage portal that exposed tenant records across institutions, and argues continuous external testing can catch risks annual pentests miss.

Key points

• Sprocket says a recent engagement at a regional bank found a third-party mortgage portal API that returned institution records without authentication or a session.
• The portal exposed its tenant ID in public files; incrementing IDs reportedly returned records for other institutions on the shared platform.
• Returned records reportedly included staff names, business email addresses, direct-dial numbers, job titles, and borrower-submission attribution codes.
• The article says possession of a valid attribution code could allow a caller to submit a prospective borrower application in a named officer's name.
• The article argues annual testing can miss newly added or vendor-operated assets and findings that require manual validation, and advocates continuous external reconnaissance and active testing.
• It cites Mandiant's 2026 report for a 14-day median dwell time in 2025 and an average of 122 days for espionage actors.

Industries