CWE-551.

ImageMagick: Policy Bypass when using coder as the domain.

• ImageMagick
• CWE-551

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

• Red Hat build of Quarkus 3.27.5.SP2
• Red Hat build of Quarkus 3.33.3.SP2
• CWE-551

Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Red Hat Advanced Cluster Management for Kubernetes 2.14
• CWE-551

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Broken access control
• CWE-551

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• CWE-178
• CWE-551

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

• Authentication bypass
• Broken access control

<3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0 · fixed in 3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, 3.37.0

fast-uri vulnerable to host confusion via failed IDN canonicalization

• CWE-436
• CWE-551

>=2.3.1, <2.4.2 || >=3.0.0, <3.1.3 || >=4.0.0, <4.0.1 · fixed in 2.4.2, 3.1.3, 4.0.1

Peplink InControl: Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass…

• Peplink InControl
• CWE-551

Insecure direct object reference in ChromaDB

• ChromaDB
• Broken access control
• CWE-551

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

• Authentication bypass
• CWE-551

>=15.2.0, <15.5.16 || >=16.0.0, <16.2.5 · fixed in 15.5.16, 16.2.5

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

• Authentication bypass
• CWE-551

>=15.4.0, <15.5.16 || >=16.0.0, <16.2.5 · fixed in 15.5.16, 16.2.5

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

• Broken access control
• CWE-551

>=12.2.0, <15.5.16 || >=16.0.0, <16.2.5 · fixed in 15.5.16, 16.2.5

Quarkus has Authentication/Authorization bypasses

• Authentication bypass
• Broken access control

<3.20.6.1 || >=3.21.0, <3.27.3.1 || >=3.30.0, <3.33.1.1 || >=3.34.0, <3.35.1.1 · fixed in 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1

Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

• Authentication bypass
• CWE-551

>=4.14.1, <4.14.6 || >=4.18.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.6, 4.18.2, 4.20.0

Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

• Broken access control
• CWE-551

>=7.0.0, <7.0.5 · fixed in 7.0.5

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

• Erlang OTP
• Broken access control
• CWE-551

Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

• CWE-551

<26.5.7 · fixed in 26.5.7

gRPC-Go has an authorization bypass via missing leading slash in :path

• Broken access control
• CWE-551

<1.79.3 · fixed in 1.79.3

ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction

• ZKTeco Inc. ZKTeco ZKBioSecurity
• CWE-551

Nest has a Fastify URL Encoding Middleware Bypass

• Broken access control
• CWE-551

<11.1.14 · fixed in 11.1.14

Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

• CWE-551

<=26.5.0 · no fixed version yet

Authorization bypass in Quarkus

• Broken access control
• CWE-551

>=2.14.0, <3.5.3 || <2.13.9.Final · fixed in 3.5.3, 2.13.9.Final

Dompdf vulnerable to URI validation failure on SVG parsing

• Broken access control
• CWE-551

<2.0.2 · fixed in 2.0.2

Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service

• Juniper Networks Junos OS
• Broken access control
• CWE-551

Incorrectly handling of URI '#fragment' element as part of the path element

• envoy
• Broken access control
• CWE-551

Incorrect concatenation of multiple value request headers in ext-authz extension

• envoy
• Broken access control
• CWE-551

Encoded URIs can access WEB-INF directory in Eclipse Jetty

• Information disclosure
• Broken access control

>=9.4.37, <9.4.43 || >=10.0.1, <10.0.6 || >=11.0.1, <11.0.6 · fixed in 9.4.43, 10.0.6, 11.0.6

Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

• Denial of service
• CWE-551

>=7.2.2, <9.4.39 || >=10.0.0, <10.0.2 || >=11.0.0, <11.0.2 · fixed in 9.4.39, 10.0.2, 11.0.2

Authorization Before Parsing and Canonicalization in jetty

• Information disclosure
• Broken access control

>=9.4.37, <9.4.39 · fixed in 9.4.39