Skip to content
Noroxi

CWE-647 · 17 records

Use of Non-Canonical URL Paths for Authorization Decisions

CVEs in this class

17 records

  • CVE-2022-43939
    97Now

    Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    hitachi · vantara pentaho business analytics serverApr 3, 2023

  • GHSA-f54f-hr32-586f
    37Monitor

    Duplicate Advisory: `allowed_domains` can be bypassed by putting a decoy domain in http auth username portion of a URL

    CriticalCVSS 9.3No exploit

    PyPI · browser-useMay 3, 2025

  • CVE-2026-80515
    35Monitor

    In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whet

    HighCVSS 8.9No exploitEPSS 0%

    eclipse foundation · eclipse arrowheadSep 3, 2026

  • CVE-2026-62685
    32Monitor

    File Browser: Colliding username normalization gives two users the same home directory

    HighCVSS 8.1No exploitEPSS 0%

    filebrowser · filebrowserJul 15, 2026

  • CVE-2026-59731
    32Monitor

    Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

    HighCVSS 8.2No exploitEPSS 0%

    withastro · astroJul 8, 2026

  • CVE-2025-64500
    29Monitor

    Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

    HighCVSS 7.3Proof of conceptEPSS 1%

    sensiolabs · httpfoundationNov 12, 2025

  • CVE-2025-66202
    26Monitor

    Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

    MediumCVSS 6.5No exploitEPSS 0%

    astro · astroDec 9, 2025

  • CVE-2025-9909
    26Monitor

    Aap-gateway: improper path validation in gateway allows credential exfiltration

    MediumCVSS 6.7No exploitEPSS 0%

    redhat · ansible automation platformFeb 27, 2026

  • GHSA-c534-2w9c-x7fm
    26Monitor

    Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

    MediumCVSS 6.5No exploit

    Go · github.com/zxh326/kiteJul 24, 2026

  • CVE-2026-94269
    25Monitor

    Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch

    MediumCVSS 6.3No exploitEPSS 0%

    apache software foundation · apache apisixOct 1, 2026

  • CVE-2026-73551
    21Monitor

    Envoy: Path normalization does not handle dot and dotdot segments with parameters

    MediumCVSS 5.3No exploitEPSS 0%

    envoyproxy · envoySep 21, 2026

  • CVE-2026-8384
    21Monitor

    In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admi

    MediumCVSS 5.3No exploitEPSS 0%

    eclipse · jettyJul 14, 2026

  • CVE-2025-47241
    16Monitor

    In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority

    MediumCVSS 4.0No exploitEPSS 0%

    browser-use · browser-useMay 3, 2025

  • CVE-2026-15970
    16Monitor

    L7 intention authorization bypass via custom public listener

    MediumCVSS 4.2No exploitEPSS 0%

    hashicorp · consulAug 7, 2026

  • CVE-2026-71178
    14Monitor

    Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization

    LowCVSS 3.7No exploitEPSS 0%

    dell · policy manager for secure connect gatewaySep 23, 2026

  • CVE-2025-43916
    13Monitor

    Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authori

    LowCVSS 3.4No exploitEPSS 0%

    sonos · api.sonos.comApr 21, 2025

  • CVE-2026-5222
    9Monitor

    Cargo can be coerced to share credentials between registries

    LowCVSS 2.3No exploitEPSS 0%

    rust-lang · cargoMay 25, 2026

All vulnerability classes