AIKIDO-2026-10505

TL;DR

Affected versions of this package are vulnerable to authorization bypass in service invocation access control policies due to inconsistent path normalization between policy enforcement and request dispatch. The affected logic evaluates method paths after decoding and normalization, while the target application receives the original raw path. An attacker able to send crafted paths containing encoded traversal sequences or reserved URL characters can cause access control checks to approve one path while a different path is executed, potentially bypassing configured method restrictions and invoking unauthorized endpoints.