AIKIDO-2026-544773

TL;DR

The framework engine assigns the flight.allow_method_override configuration flag inside a before('start') hook that first constructs the Request object, which caches the request verb using the static flag while it is still at its default enabled value. As a result the opt-out never influences routing, and an X-HTTP-Method-Override header or a _method field is still honored even when an operator disabled method override. A user-controlled request with a safe verb can be dispatched to a handler registered for a different HTTP method, bypassing middleware gated on the verb and enabling cross-site request forgery against destructive routes. The fix assigns the static flag before the request is built and refreshes the already-cached verb so the setting takes effect.