AIKIDO-2025-10204

TL;DR

Affected versions of this package are vulnerable to an authorization bypass due to improper validation of internal requests. The middleware exempts internal requests from authorization checks but fails to verify their authenticity, allowing attackers to spoof internal requests and bypass access controls. By crafting a request with a forged internal flag, an attacker can gain unauthorized access to protected routes or critical system functionalities.