AIKIDO-2026-10380

TL;DR

Affected versions of this package are affected by an authentication bypass vulnerability due to improper path validation when exempting health check endpoints from authentication. The implementation uses a suffix-based check (e.g., endswith) to determine whether a request should bypass authentication, allowing crafted request paths that end with the expected suffix to incorrectly skip authentication. An attacker could exploit this by accessing protected endpoints using specially crafted URLs that match the suffix condition. The issue is addressed by enforcing strict validation of allowed paths when applying authentication exemptions.