The used-vehicle checkout exposed an order call. It required no cookie, no customer login, and no anti-forgery token that the caller could not read from the public page. The body was an offer id.
Offer ids were available from an unauthenticated listing of live offers on the same site. One call with one live offer id returned accepted, type order-placed.
That offer belonged to a real customer, not a test fixture. Before the call its status was in progress. After the call the same offer read back as order-placed. We stopped. No second write. No payment. No delivery step.
What we proved
One unauthenticated state change on one live offer, confirmed by a read before and a read after.
What this is not
Not a paid vehicle, not a captured card, not a campaign against the catalogue. One call, then a stop. The severity is the missing authentication on a purchase-state change, demonstrated once.
Why a scanner misses it
The happy path is a browser session on a public marketing site. A scanner that only flags 401-versus-200 on obvious /admin paths does not treat "place order" as an anonymous function, and it should not be spraying live offer ids to find out.
Buyer takeaway: A checkout that keys only on an offer id is a purchase API. Authentication is the offer's customer, not the presence of a header copied from the page.
