AIKIDO-2026-266800

TL;DR

The security middleware resolves the matched route by walking the ASGI mount hierarchy with a hardcoded recursion depth cap. When a protected endpoint sits behind more nested mounts than the cap allows, route resolution gives up before reaching it and the per-route guard state is never populated. The downstream authentication handler treats the missing route configuration as nothing to enforce and lets the request through, so per-route authentication decorators are bypassed for deeply nested routes even though identical decorators enforce correctly at shallower depths. The fix replaces the fixed depth cap with a cycle-guarded traversal that reaches routes at any nesting depth.