CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Description
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-551 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-4c8g-83qw-93j6 | CVE-2026-13676 | HIGH |
fast-uri vulnerable to host confusion via failed IDN canonicalization |
2026-09-11 | |
| GHSA-rc95-pcm8-65v9 | CVE-2026-39852 | HIGH |
Quarkus has Authentication/Authorization bypasses |
2026-08-13 | |
| GHSA-qcxp-gm7m-4j5v | CVE-2026-50559 | HIGH |
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities |
2026-07-30 | |
| GHSA-gv94-wp4h-vv8p | CVE-2026-0707 | MODERATE |
Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization |
2026-06-09 | |
| GHSA-f2hx-5fx3-hmcv | CVE-2026-4636 | HIGH |
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants |
2026-04-04 | |
| GHSA-mvc8-6ffp-jrx5 | CVE-2023-6394 | HIGH |
Authorization bypass in Quarkus |
2024-08-02 | |
| GHSA-3cw5-7cxw-v5qg | CVE-2023-23924 | CRITICAL | - |
Dompdf vulnerable to URI validation failure on SVG parsing |
2023-02-01 |
| GHSA-26vr-8j45-3r4w | CVE-2021-28165 | HIGH |
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources |
2022-08-10 | |
| GHSA-vjv5-gp2w-65vm | CVE-2021-34429 | MODERATE |
Encoded URIs can access WEB-INF directory in Eclipse Jetty |
2022-04-19 | |
| GHSA-v7ff-8wcx-gmc5 | CVE-2021-28164 | MODERATE |
Authorization Before Parsing and Canonicalization in jetty |
2022-04-17 |