Unauthenticated API Access & Internal Data Exposure.

The API at “Subdomain.target.local” implements zero authentication on all observed endpoints. There are no API keys, Bearer tokens, OAuth…