AIKIDO-2026-393086

TL;DR

The Rack::TwilioWebhookAuthentication middleware checks incoming webhook requests against a list of configured protected paths using only the raw, un-normalized PATH_INFO value. A request for a percent-encoded, dot-segment, or duplicate-slash variant of a protected path (for example /%76oice instead of /voice) still routes to the protected action but does not match any configured entry, so the middleware skips X-Twilio-Signature validation entirely. This lets unsigned, unauthenticated requests reach the protected webhook handler as though they carried a valid Twilio signature. The fix adds a protected_path? check that also compares decoded and normalized forms of the request path before allowing a request through unsigned.