CWE-647 · Access Control
Use of Non-Canonical URL Paths for Authorization Decisions
18CVEs
SortMost likely exploited
18 CVEs with CWE-647 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-43939In CISA KEVExploitedHitachi Pentaho Business Analytics Server - Bypass AuthorizationHitachi Vantara · Pentaho Business Analytics Server · CVSS 8.6 · 2023-04-03 | 8.6 | 92% | 2023-04-03 |
| CVE-2025-64500CheckSymfony HttpFoundation - Access Control Bypass via PATH_INFOsymfony · symfony · CVSS 7.3 · 2025-11-12 | 7.3 | 1.4% | 2025-11-12 |
| CVE-2026-62685File Browser: Colliding username normalization gives two users the same home directoryfilebrowser · filebrowser · CVSS 8.1 · 2026-07-15 | 8.1 | 0.6% | 2026-07-15 |
| CVE-2026-73551Envoy: Path normalization does not handle dot and dotdot segments with parametersenvoyproxy · envoy · CVSS 5.3 · 2026-09-21 | 5.3 | 0.5% | 2026-09-21 |
| CVE-2026-5222Cargo can be coerced to share credentials between registriesRust · Cargo · CVSS 2.3 · 2026-05-25 | 2.3 | 0.5% | 2026-05-25 |
| CVE-2026-80515In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling reque…Eclipse Foundation · Eclipse Arrowhead · CVSS 8.9 · 2026-09-03 | 8.9 | 0.5% | 2026-09-03 |
| CVE-2025-47241In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.browser-use · browser-use · CVSS 4 · 2025-05-03 | 4.0 | 0.5% | 2025-05-03 |
| CVE-2026-121823A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based acc…LY Corporation · Armeria · CVSS 8.7 · 2026-11-06 | 8.7 | 0.4% | 2026-11-06 |
| CVE-2025-66202Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765withastro · astro · CVSS 6.5 · 2025-12-08 | 6.5 | 0.3% | 2025-12-08 |
| CVE-2026-59731Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatchwithastro · astro · CVSS 8.2 · 2026-07-08 | 8.2 | 0.3% | 2026-07-08 |
| CVE-2026-8384In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt J…Eclipse Foundation · Eclipse Jetty · CVSS 5.3 · 2026-07-14 | 5.3 | 0.3% | 2026-07-14 |
| CVE-2026-93335Vault vulnerable to ACL deny bypass via trailing slashHashiCorp · Vault · CVSS 6.5 · 2026-11-12 | 6.5 | 0.3% | 2026-11-12 |
| CVE-2026-94269Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatchApache Software Foundation · Apache APISIX · CVSS 6.3 · 2026-10-01 | 6.3 | 0.3% | 2026-10-01 |
| CVE-2026-76530Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOARSplunk · Splunk SOAR · CVSS 8.8 · 2026-10-21 | 8.8 | 0.3% | 2026-10-21 |
| CVE-2026-71178Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenti…Dell · Secure Connect Gateway (SCG) Policy Manager · CVSS 3.7 · 2026-09-23 | 3.7 | 0.2% | 2026-09-23 |
| CVE-2025-43916Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent w…Sonos · api.sonos.com · CVSS 3.4 · 2025-04-21 | 3.4 | 0.2% | 2025-04-21 |
| CVE-2026-15970L7 intention authorization bypass via custom public listenerHashiCorp · Consul · CVSS 4.2 · 2026-08-07 | 4.2 | 0.2% | 2026-08-07 |
| CVE-2025-9909Aap-gateway: improper path validation in gateway allows credential exfiltrationRed Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8 · CVSS 6.7 · 2026-02-27 | 6.7 | 0.2% | 2026-02-27 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.