API versioning attacks

When it applies

The API exposes multiple versions and a vulnerability fixed in the current version still lives in an older or undocumented one. Old versions rarely get the same auth, validation, or rate-limit hardening.

Why it works

Teams patch the latest version and leave /v1 (and /beta, /internal, dated versions) running for backward compatibility. Those endpoints often skip a fix, lack a new authz check, or expose fields later removed — same data, weaker guard.