# Authz path vs handler routing mismatch

Authorizer checks URL path or client header; router dispatches on a different string to a protected handler

_Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-10-13. Updated 2026-10-23._

## How it works
A front-end gate decides whether a request is authenticated by inspecting one string (the URL path, or a client-supplied header), but the back-end that actually handles the request dispatches on a different string. The two views of "which handler runs" diverge, so a request the gate treats as public is delivered to a protected handler. The broken assumption: the string the authorizer evaluates is the same resolved target the router uses.

## Where it shows up
- Front-end proxy authorizes by path prefix (`strncmp`) while the backend resolves routes after normalization or `../` traversal [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-high-signal-detection-and-exploitation-of-ivantis-pulse-connect-secure-auth-bypass-rce.md)
- Authorizer keyed on URL path but router keyed on a header such as `X-DSCGI-PATH` [E1](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-10-13-a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days.md)
- Auth gates that skip session checks on client-controlled input (a `User-Agent` string, a `bmID` parameter prefix), exposing localhost-only services behind a proxy [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation.md)
- Any place a gate and a dispatcher each parse the request independently

## How to review
Trace one request end to end: identify the exact string the authorizer evaluates and the exact string the router dispatches on, and confirm they are identical after all decoding, normalization and traversal resolution. Invariant: no request may reach a protected handler unless the authorizer evaluated the same resolved target the handler will use. Auth decisions must never depend on client-controlled headers or parameter prefixes. Check that prefix allowlists reject `../` and that the backend re-checks auth rather than trusting the proxy.

## Variants seen
- Path-prefix allowlist bypassed with `../` traversal to reach REST endpoints [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-high-signal-detection-and-exploitation-of-ivantis-pulse-connect-secure-auth-bypass-rce.md)
- Path-based authz vs header-based routing (`X-DSCGI-PATH`) [E1](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-10-13-a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days.md)
- Gate keyed on spoofable header/parameter skipping session checks, tunneling to localhost services [E2](https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation.md)

## Impact and severity
Unauthenticated reach into protected handlers on perimeter VPN appliances. In E1 the mismatch was the entry point of a chain ending in unauthenticated root; in E3 traversal reached a handler with shell injection for root RCE; in E2 the header/parameter gate exposed localhost services, chained with separate traversal to root RCE. Critical: pre-auth access to privileged services, worsened by chaining and by edge devices at the network perimeter.

## Why fixes fail
Fixing only the gate (or only the router) leaves the other parser divergent; the property must hold on both sides of the same resolved target.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-10-13-a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days.md
- E2: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation.md
- E3: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-high-signal-detection-and-exploitation-of-ivantis-pulse-connect-secure-auth-bypass-rce.md