Skip to content
OpenAdvisories

Weakness (CWE)

CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Base Incomplete

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

More detail

For instance, the character strings /./ and / both mean current directory. If /SomeDirectory is a protected directory and an attacker requests /./SomeDirectory, the attacker may be able to gain access to the resource if /./ is not converted to / before the authorization check is performed.

How to prevent it (1 mitigation)

  1. Architecture and Design

    URL Inputs should be decoded and canonicalized to the application's current internal representation before being validated and processed for authorization. Make sure that your application does not decode the same input twice. Such errors could be used to bypass allowlist schemes by introducing dangerous inputs after they have been checked.

Source: MITRE CWE-551

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.2
    CVE-2026-40022 Public exploit

    Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

    When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenti…

    Apache Software Foundation Apache Camel Platform HTTP Main org.apache.camel:camel-platform-http-main Maven
  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go rclone google-guest-agent Debian Ubuntu Alpine Go
  • Critical 10.0
    CVE-2023-23924 Public exploit

    URI validation failure on SVG parsing in Dompdf

    Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can e…

    dompdf dompdf dompdf/dompdf Packagist
  • Medium 5.3
    CVE-2021-34429 Public exploit EPSS 99%

    Encoded URIs can access WEB-INF directory in Eclipse Jetty

    For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reporte…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • High 7.5
    CVE-2021-28165 Public exploit EPSS 54%

    Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

    In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-28164 Public exploit EPSS 82%

    Authorization Before Parsing and Canonicalization in jetty

    In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-webapp Debian Ubuntu Maven