# Double forward slash breaks server-side restrictions & allows access to prohibited services from a partner account

Double-slash prefix on autorebates API path bypassed server-side geo/partner restrictions, letting an India partner access the prohibited Autorebates facility.

- Payout: hidden
- Severity: low
- Program: EXNESS
- Found by: ashwarya
- Disclosed: 2023-02-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1829170
- Library page: https://bugbountylibrary.com/r/h1%3A1829170
- Tags: area:web domain:api kind:bounty platform:hackerone sev:low technique:chained vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Partner API endpoint /api/v2/autorebates/groups/
**Root cause:** Access-control check matched on the normalized single-slash path, but the backend routed the double-slash path to the same handler without re-applying the restriction.
**Steps:**
1. Authenticate as a partner account from India (Autorebates unavailable).
2. Send `POST /api/v2/autorebates/groups/` with JWT -> `HTTP/2 403 Forbidden`.
3. Resend as `POST //api/v2/autorebates/groups/` with body `{"group_title":"Test"}` -> request succeeds.
4. Observe client group created despite restriction.
**How found:** Researcher noticed a 403 on the direct endpoint and tried appending extra forward slashes, observing the restriction no longer applied.
**Exploitation:** Partner sends the same authenticated request with a leading double slash; the routing layer treats it as a distinct path and skips the restriction middleware, reaching the autorebates handler and creating groups.
**Insight:** When a 403 blocks a feature, try path variants (//, ///, /./, encoded slashes) that may route to the same handler while evading path-based middleware matching.