Chained vulnerabilities

What it means

Chained vulnerabilities are flaws used one after another, where each step makes the next possible. A weakness that looks minor on its own becomes the doorway to something serious once it is paired with another. The harm comes from the combination, not from any single link.

Think of a leaked internal ID, an endpoint that trusts that ID, and a response that returns more than it should. None of the three would be rated critical by itself. Together they let a stranger read another customer's data.

Why it matters

Severity is usually scored one flaw at a time, so chains fall through the gaps. Two findings marked low and informational can sit in a backlog for a year, while together they amount to a serious breach. The CVSS vector of each part says little about the whole.

Attackers do not think in individual findings. They think about where they can get to. A defender who only fixes the loudest items can leave a quiet route open, which is why an attack path view is often more useful than a flat list.

How it shows up

Familiar chains include an open redirect used to steal an OAuth code, a script injection used to read a CSRF token and then send a forged request, or a server-side request flaw that reaches cloud metadata and returns credentials. Another is user enumeration followed by password guessing.

To find chains, a tester asks what each small finding gives them: a user ID, a token, an internal address, a foothold. Then they try to use it. Treat low-rated items as possible links, and review them together before closing them as unimportant.