Account takeover via SQL injection

A login-bypass payload authenticates as the first user with no valid password.

Attack

Login with ' OR '1'='1' --.

Nemesis defense

Application Shield blocks the injection in the submitted fields.

Modelled on

Sterling Bank (2026): WebLogic middleware auth-bypass, PII for 900k+ customers.

Endpoint

POST /api/login