CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions
Description
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-647 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-c534-2w9c-x7fm | - | MODERATE |
Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources |
2026-07-24 | |
| GHSA-w7x5-g22v-xqhr | CVE-2026-8384 | MODERATE |
Eclipse Jetty: Path parameter traversal |
2026-07-22 | |
| GHSA-7rc3-g7h6-22m7 | CVE-2026-62685 | HIGH |
File Browser: Colliding username normalization gives two users the same home directory |
2026-07-20 | |
| GHSA-vj59-8hwv-xxmv | CVE-2026-59731 | HIGH |
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch |
2026-07-20 | |
| GHSA-p688-r7jv-fm6f | CVE-2026-5222 | LOW | - |
Cargo can be coerced to share credentials between registries |
2026-06-26 |
| GHSA-whqg-ppgf-wp8c | CVE-2025-66202 | MODERATE |
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 |
2025-12-09 | |
| GHSA-3rg7-wf37-54rm | CVE-2025-64500 | HIGH | - |
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass |
2025-11-15 |
| GHSA-x39x-9qw5-ghrf | CVE-2025-47241 | CRITICAL |
Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL |
2025-05-05 | |
| GHSA-f54f-hr32-586f | - | CRITICAL |
Duplicate Advisory: `allowed_domains` can be bypassed by putting a decoy domain in http auth username portion of a URL |
2025-05-05 |