Skip to content
Threat Feed

Tag

Url-Encoding

1 brief RSS
high advisory

Heimdall Authorization Bypass via Case-Sensitive URL-Encoded Slash Handling

Heimdall versions before 0.17.14 are vulnerable to inconsistent path interpretation due to case-sensitive handling of URL-encoded slashes; when `allow_encoded_slashes` is set to `off` (the default), the lowercase `%2f` is not recognized, potentially leading to authorization bypass if the default rule is overly permissive and the upstream service interprets `%2f` as a path separator.

Heimdall authorization-bypass url-encoding
2r 1t