VYPR

CWE-551

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

BaseIncomplete

Description

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

For instance, the character strings /./ and / both mean current directory. If /SomeDirectory is a protected directory and an attacker requests /./SomeDirectory, the attacker may be able to gain access to the resource if /./ is not converted to / before the authorization check is performed.

Hierarchy (View 1000)

Children

none

CVEs mapped to this weakness (23)

page 2 of 2
  • CVE-2023-6394HigDec 9, 2023
    Quarkusio
    Quarkus
    risk 0.41cvss 7.4epss 0.01

    A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access…

  • CVE-2026-0707MedJan 8, 2026
    Keycloak
    Keycloak
    risk 0.27cvss 5.3epss 0.00

    A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750…

  • CVE-2026-57920HigJun 26, 2026
    Peplink
    InControl 2
    risk 0.00cvss 7.7epss 0.00

    Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.