CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Filter
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical.
What the weakness is: CWE-647 at MITRE. All weaknesses
Ask an AI about CWE-647
Show the prompt
Explain CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/647.html and https://cve.bz/cve/cwe/647?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2026-76530EPSS 0.3%
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discover…
- 6.3CVE-2026-94269EPSS 0.3%
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched …
- 3.7CVE-2026-71178EPSS 0.2%
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit …
- 5.3CVE-2026-73551EPSS 0.5%
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parame…
- 8.9CVE-2026-80515EPSS 0.5%
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat ret…
- 4.2CVE-2026-15970EPSS 0.2%
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP path…
- 8.1CVE-2026-62685EPSS 0.6%
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() wh…
- 5.3CVE-2026-8384EPSS 0.3%
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not af…
- 8.2CVE-2026-59731EPSS 0.3%
Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional …
- 2.3CVE-2026-5222EPSS 0.5%
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker …
- 6.7CVE-2025-9909EPSS 0.2%
A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A maliciou…
- 6.5CVE-2025-66202EPSS 0.3%
Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected route…
- 7.3CVE-2025-64500ExploitEPSS 1.4%
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to versio…
- 4.0CVE-2025-47241EPSS 0.5%
In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.
- 3.4CVE-2025-43916EPSS 0.2%
Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be s…
- 9.8CVE-2022-43939KEVExploitEPSS 92%
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.