Thoughts about reporting SPA as Broken access control

I read the rules. Please let me know if there is a better place to have this discussion.



I recently received a pen testing report for an SPA (Single Page Application) with only one major vulnerability reported, with a CVSS of 8.1.



The reported issue is classified as "Broken access control".



In this deficiency, they report that by patching the client-side authentication logic in the SPA or using a proxy and modifying the authentication response from the server.



They then …

access access control application broken access control classified control cvss cybersecurity issue major page pen pen testing report reporting rules single single page application spa testing thoughts vulnerability