ServiceNow Scripted REST Resource Unauthenticated Access via Missing Credential Enforcement

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects successful (HTTP 200) requests to ServiceNow API endpoints (/api/now/) that lack proper authentication, such as requests by the 'guest' user or requests missing authorization headers or session tokens.