Imperva Report Finds Nearly 40% of Analyzed API Endpoints Have Multiple Authentication Risks
Report discovered via Awesome Annual Security Reports.
Summary
Imperva’s analysis of 32,725 API endpoints found nearly 40% had multiple authentication risks. Sensitive data in JWTs remained the most common risk, while access with expired tokens rose from 5.0% to 8.5%.
Key points
- The report analyzed authentication and token-handling detections across 1,104 customer accounts and 32,725 API endpoints, comparing 2025 with 2026.
- Sensitive data in JWT payloads was the most common risk, increasing from 46.0% to 49.8% of detections.
- Expired-token access increased from 5.0% to 8.5%, the largest relative change reported; Imperva says the cause could include customer changes, improved detection, or a shift in the accounts measured.
- Long-lived JWTs, weak signing algorithms, and Basic Authentication with raw credentials each declined in prevalence.
- Of the endpoints analyzed, 13,016 (39.8%) had more than one of the five tracked risks; the highest-risk endpoint had all five.
- Imperva recommends minimizing sensitive JWT payload data, enforcing token expiration server-side, reviewing flagged endpoints for multiple risks, and migrating remaining Basic Auth endpoints to OAuth2 or mTLS.
Article Details
- Publisher
- Thales Imperva
- Report Period
- 2025–2026 comparison
- Scope
- Authentication and token-handling risks across API endpoints observed in customer environments.
- Sample Size
- 1,104 customer accounts and 32,725 API endpoints.
- Key Statistics
- Sensitive data in JWTs was detected on 49.8% of endpoints in 2026, up from 46.0% in 2025.
- Expired-token access was detected on 8.5% of endpoints in 2026, up from 5.0% in 2025—a 70% relative increase.
- 13,016 of 32,725 endpoints (39.8%) had more than one authentication risk.
- The highest-risk endpoint identified had all five tracked risk types.
- Recommendations
- Review JWT payloads, remove unnecessary sensitive data, and consider opaque reference-style tokens where appropriate.
- Enforce exp and nbf claims server-side across token-validating services; review cache and session-invalidation logic.
- Migrate remaining Basic Authentication endpoints to OAuth2 or mTLS, shorten token lifetimes, and enforce strong signing algorithms across legacy and third-party services.
- Audit all authentication risks on endpoints flagged for any one risk.
- Re-measure the environment regularly using a consistent method.