Because POST /cart accepts the product price from the browser, changing price=133700 to price=1 adds the leather jacket for one cent. The server should derive prices from its own catalog rather than client input.
The cart remembers only the last coupon. Alternating SIGNUP30 and NEWCUST5 therefore reapplies both discounts until the $1,337 jacket falls below the $100 balance.
A signed quantity in POST /cart permits negative line items that offset the jacket's price. Balancing those entries to a small positive total lets checkout succeed despite insufficient funds.
An overlong email is delivered in full but truncated before authorization, yielding a stored address in the privileged domain.
Registration verifies an email address, but /my-account/change-email immediately trusts a replacement. Setting [email protected] satisfies the domain-only /admin rule.
A reusable discount makes a gift card cost less than the credit received when it is redeemed. Repeating the purchase-and-redeem cycle increases the account balance.
Calling the final checkout endpoint out of sequence skips the payment transition while the server still accepts the purchase.
Repeated quantity=99 additions overflow the cart's signed 32-bit total and wrap it below zero. Further adjustments place the total within the account balance, allowing an otherwise unaffordable purchase.
Removing current-password from the dual-use change endpoint selects a weaker branch that resets the administrator credential.
The authentication state machine assumes every user completes the role-selection transition after login. Dropping that request leaves the new session in an unsafe default state with access to administrative functionality.