AIKIDO-2026-132102

TL;DR

The request.awsLambda decoration, which exposes event and context for handlers that read API Gateway authorizer claims, resolves those values from the client-controlled x-apigateway-event and x-apigateway-context headers before falling back to the internal per-invocation token, and those reserved headers are not stripped from the incoming proxy event. An unauthenticated caller who can set a single HTTP header can therefore forge the entire Lambda event, including requestContext.authorizer, and override the genuine one. Any application that trusts request.awsLambda.event for identity or access control can be fully authentication- and authorization-bypassed. The fix resolves the decoration only through the internal token map and strips the reserved headers before the request is injected.