CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- imagemagick ImageMagick: Policy Bypass when using coder as the domain. 6.2 Medium
- red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +8 more +10 more Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security 7.5 High
- red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14, advanced cluster management for kubernetes 2.15 +2 more +4 more Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references 7.7 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 more Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers 8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 more Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher 8.1 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 more fast-uri vulnerable to host confusion via failed IDN canonicalization 7.5 High
- intelbras incontrol, peplink intcontrol 2 +1 more Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access... 7.7 High
- quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 more Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities 7.5 High
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 more All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and... 8.8 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 7.5 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Middleware / Proxy bypass through dynamic route parameter injection 8.1 High
- quarkus, red hat cryostat 4 on rhel 9, hawtio hawtio 4.4.0 +16 more +18 more Quarkus authorization bypass via semicolon path normalization inconsistency 8.8 High
- apache camel, apache software foundation camel platform http main, red hat openshift serverless +7 more +9 more Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime 8.2 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 more ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules 7.5 High
- erlang otp, erlang\/inets, erlang\/otp +3 more +5 more ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch) 8.3 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 more Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. 8.1 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 more gRPC-Go has an authorization bypass via missing leading slash in :path 9.1 Critical
- zkteco inc. zkbiosecurity ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction 9.3 Critical
- nest.js, nestjs nest, red hat developer hub +1 more +3 more NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass 8.2 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 more Next.js: Middleware / Proxy bypass in Pages Router applications using i18n 7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10 +1 more Keycloak: keycloak authorization header parsing leading to potential security control bypass 5.3 Medium
- quarkus, red hat build of quarkus, build of quarkus 2.13.9 +1 more +3 more Quarkus: graphql operations over websockets bypass 7.4 High
- dompdf URI validation failure on SVG parsing in Dompdf 10.0 Critical
- juniper junos, juniper networks junos os +1 more Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service 7.2 High
- envoyproxy envoy Incorrectly handling of URI '#fragment' element as part of the path element 8.6 High
- envoyproxy envoy Incorrect concatenation of multiple value request headers in ext-authz extension 8.6 High
- eclipse jetty, the eclipse foundation eclipse jetty, netapp e-series santricity os controller +16 more +18 more Encoded URIs can access WEB-INF directory in Eclipse Jetty 5.3 Medium
- eclipse jetty, the eclipse foundation eclipse jetty, jenkins +19 more +21 more Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources 7.5 High
- eclipse jetty, the eclipse foundation eclipse jetty, netapp cloud manager +15 more +17 more Authorization Before Parsing and Canonicalization in jetty 5.3 Medium