# CWE-551.

Every Advisory and CVE whose sources give the weakness CWE-551, newest first.

## Records, newest first

- [ImageMagick: Policy Bypass when using coder as the domain.](https://agentprime.io/advisories/CVE-2026-106579.md)
  `CVE-2026-106579` · CVE record: ImageMagick ImageMagick · CVSS 6.2 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-551
- [Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security](https://agentprime.io/advisories/CVE-2026-87743.md)
  `CVE-2026-87743` · CVE record: Red Hat Red Hat build of Quarkus 3.27.5.SP2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-551
- [Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references](https://agentprime.io/advisories/CVE-2026-89060.md)
  `CVE-2026-89060` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 and 4 more · CVSS 7.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-551
- [Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers](https://agentprime.io/advisories/CVE-2026-16102.md)
  `CVE-2026-16102` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Broken access control, CWE-551
- [Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher](https://agentprime.io/advisories/CVE-2026-15573.md)
  `CVE-2026-15573` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-178, CWE-551
- [Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities](https://agentprime.io/advisories/GHSA-qcxp-gm7m-4j5v.md)
  `GHSA-qcxp-gm7m-4j5v`, `CVE-2026-50559` · Maven `io.quarkus:quarkus-vertx-http`: affected `<3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0`, fixed in `3.20.6.2`, `3.27.4.1`, `3.33.2.1`, `3.36.3`, `3.37.0` · CVSS 7.5 High · Not analysed yet · Published 29 Jul 2026 · Tags: Authentication bypass, Broken access control, CWE-41, CWE-178
- [fast-uri vulnerable to host confusion via failed IDN canonicalization](https://agentprime.io/advisories/GHSA-4c8g-83qw-93j6.md)
  `GHSA-4c8g-83qw-93j6`, `CVE-2026-13676` · npm `fast-uri`: affected `>=2.3.1, <2.4.2 || >=3.0.0, <3.1.3 || >=4.0.0, <4.0.1`, fixed in `2.4.2`, `3.1.3`, `4.0.1` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-436, CWE-551
- [Peplink InControl: Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass…](https://agentprime.io/advisories/CVE-2026-57920.md)
  `CVE-2026-57920` · CVE record: Peplink InControl · CVSS 7.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-551
- [Insecure direct object reference in ChromaDB](https://agentprime.io/advisories/CVE-2026-45832.md)
  `CVE-2026-45832` · CVE record: Chroma ChromaDB · CVSS 8.8 High · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control, CWE-551
- [Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes](https://agentprime.io/advisories/GHSA-267c-6grr-h53f.md)
  `GHSA-267c-6grr-h53f`, `CVE-2026-44575` · npm `next`: affected `>=15.2.0, <15.5.16 || >=16.0.0, <16.2.5`, fixed in `15.5.16`, `16.2.5` · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: Authentication bypass, CWE-551
- [Next.js has a Middleware / Proxy bypass through dynamic route parameter injection](https://agentprime.io/advisories/GHSA-492v-c6pp-mqqv.md)
  `GHSA-492v-c6pp-mqqv`, `CVE-2026-44574` · npm `next`: affected `>=15.4.0, <15.5.16 || >=16.0.0, <16.2.5`, fixed in `15.5.16`, `16.2.5` · CVSS 8.1 High · Not analysed yet · Published 11 May 2026 · Tags: Authentication bypass, CWE-551
- [Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n](https://agentprime.io/advisories/GHSA-36qx-fr4f-26g5.md)
  `GHSA-36qx-fr4f-26g5`, `CVE-2026-44573` · npm `next`: affected `>=12.2.0, <15.5.16 || >=16.0.0, <16.2.5`, fixed in `15.5.16`, `16.2.5` · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: Broken access control, CWE-551
- [Quarkus has Authentication/Authorization bypasses](https://agentprime.io/advisories/GHSA-rc95-pcm8-65v9.md)
  `GHSA-rc95-pcm8-65v9`, `CVE-2026-39852` · Maven `io.quarkus:quarkus-vertx-http`: affected `<3.20.6.1 || >=3.21.0, <3.27.3.1 || >=3.30.0, <3.33.1.1 || >=3.34.0, <3.35.1.1`, fixed in `3.20.6.1`, `3.27.3.1`, `3.33.1.1`, `3.35.1.1` · CVSS 8.8 High · Not analysed yet · Published 4 May 2026 · Tags: Authentication bypass, Broken access control, CWE-551
- [Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel](https://agentprime.io/advisories/GHSA-27vm-5vpj-rp5g.md)
  `GHSA-27vm-5vpj-rp5g`, `CVE-2026-40022` · Maven `org.apache.camel:camel-platform-http-main`: affected `>=4.14.1, <4.14.6 || >=4.18.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.6`, `4.18.2`, `4.20.0` · CVSS 8.2 High · Not analysed yet · Published 27 Apr 2026 · Tags: Authentication bypass, CWE-551
- [Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules](https://agentprime.io/advisories/GHSA-4vrc-j85c-598c.md)
  `GHSA-4vrc-j85c-598c`, `CVE-2026-22754` · Maven `org.springframework.security:spring-security-config`: affected `>=7.0.0, <7.0.5`, fixed in `7.0.5` · CVSS 7.5 High · Not analysed yet · Published 22 Apr 2026 · Tags: Broken access control, CWE-551
- [ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)](https://agentprime.io/advisories/CVE-2026-28808.md)
  `CVE-2026-28808` · CVE record: Erlang OTP · CVSS 8.3 High · Not analysed yet · Published 7 Apr 2026 · Tags: Broken access control, CWE-551
- [Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants](https://agentprime.io/advisories/GHSA-f2hx-5fx3-hmcv.md)
  `GHSA-f2hx-5fx3-hmcv`, `BIT-keycloak-2026-4636`, `CVE-2026-4636` · Maven `org.keycloak:keycloak-services`: affected `<26.5.7`, fixed in `26.5.7` · CVSS 8.1 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-551
- [gRPC-Go has an authorization bypass via missing leading slash in :path](https://agentprime.io/advisories/GHSA-p77j-4mvh-x3m3.md)
  `GHSA-p77j-4mvh-x3m3`, `CVE-2026-33186`, `GO-2026-4762` · Go `google.golang.org/grpc`: affected `<1.79.3`, fixed in `1.79.3` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2026 · Tags: Broken access control, CWE-551
- [ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction](https://agentprime.io/advisories/CVE-2016-20030.md)
  `CVE-2016-20030` · CVE record: ZKTeco Inc. ZKTeco ZKBioSecurity · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Mar 2026 · Tags: CWE-551
- [Nest has a Fastify URL Encoding Middleware Bypass](https://agentprime.io/advisories/GHSA-r4wm-x892-vjmx.md)
  `GHSA-r4wm-x892-vjmx`, `CVE-2026-2293` · npm `@nestjs/platform-fastify`: affected `<11.1.14`, fixed in `11.1.14` · CVSS 8.2 High · Not analysed yet · Published 2 Mar 2026 · Tags: Broken access control, CWE-551
- [Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization](https://agentprime.io/advisories/GHSA-gv94-wp4h-vv8p.md)
  `GHSA-gv94-wp4h-vv8p`, `CVE-2026-0707` · Maven `org.keycloak:keycloak-parent`: affected `<=26.5.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-551
- [Authorization bypass in Quarkus](https://agentprime.io/advisories/GHSA-mvc8-6ffp-jrx5.md)
  `GHSA-mvc8-6ffp-jrx5`, `CVE-2023-6394` · Maven `io.quarkus:quarkus-smallrye-graphql-client`: affected `>=2.14.0, <3.5.3 || <2.13.9.Final`, fixed in `3.5.3`, `2.13.9.Final` · CVSS 7.4 High · Not analysed yet · Published 9 Dec 2023 · Tags: Broken access control, CWE-551, CWE-696
- [Dompdf vulnerable to URI validation failure on SVG parsing](https://agentprime.io/advisories/GHSA-3cw5-7cxw-v5qg.md)
  `GHSA-3cw5-7cxw-v5qg`, `CVE-2023-23924`, `PKSA-4jrs-y99s-q8j6` · Packagist `dompdf/dompdf`: affected `<2.0.2`, fixed in `2.0.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Feb 2023 · Tags: Broken access control, CWE-551
- [Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service](https://agentprime.io/advisories/CVE-2021-31384.md)
  `CVE-2021-31384` · CVE record: Juniper Networks Junos OS · CVSS 7.2 High · Not analysed yet · Published 19 Oct 2021 · Tags: Broken access control, CWE-551, CWE-939, CWE-1220
- [Incorrectly handling of URI '#fragment' element as part of the path element](https://agentprime.io/advisories/CVE-2021-32779.md)
  `CVE-2021-32779` · CVE record: envoyproxy envoy · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2021 · Tags: Broken access control, CWE-551
- [Incorrect concatenation of multiple value request headers in ext-authz extension](https://agentprime.io/advisories/CVE-2021-32777.md)
  `CVE-2021-32777` · CVE record: envoyproxy envoy · CVSS 8.6 High · Not analysed yet · Published 24 Aug 2021 · Tags: Broken access control, CWE-551
- [Encoded URIs can access WEB-INF directory in Eclipse Jetty](https://agentprime.io/advisories/GHSA-vjv5-gp2w-65vm.md)
  `GHSA-vjv5-gp2w-65vm`, `CVE-2021-34429` · Maven `org.eclipse.jetty:jetty-webapp`: affected `>=9.4.37, <9.4.43 || >=10.0.1, <10.0.6 || >=11.0.1, <11.0.6`, fixed in `9.4.43`, `10.0.6`, `11.0.6` · CVSS 5.3 Medium · EPSS 0.99 · Not analysed yet · Published 19 Jul 2021 · Tags: Information disclosure, Broken access control, CWE-551
- [Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources](https://agentprime.io/advisories/GHSA-26vr-8j45-3r4w.md)
  `GHSA-26vr-8j45-3r4w`, `BIT-jenkins-2021-28165`, `CVE-2021-28165` · Maven `org.eclipse.jetty:jetty-server`: affected `>=7.2.2, <9.4.39 || >=10.0.0, <10.0.2 || >=11.0.0, <11.0.2`, fixed in `9.4.39`, `10.0.2`, `11.0.2` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.54 · Not analysed yet · Published 6 Apr 2021 · Tags: Denial of service, CWE-551, CWE-755
- [Authorization Before Parsing and Canonicalization in jetty](https://agentprime.io/advisories/GHSA-v7ff-8wcx-gmc5.md)
  `GHSA-v7ff-8wcx-gmc5`, `CVE-2021-28164` · Maven `org.eclipse.jetty:jetty-webapp`: affected `>=9.4.37, <9.4.39`, fixed in `9.4.39` · CVSS 5.3 Medium · EPSS 0.82 · Not analysed yet · Published 6 Apr 2021 · Tags: Information disclosure, Broken access control, CWE-551

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-551>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-551/>. Everything for agents: <https://agentprime.io/llms.txt>.