# Encoded vs decoded path auth mismatch

Auth matching encoded URI or unanchored globs while handler acts on decoded path or framework-truncated path

_Area: Web access control and IDOR. Seen in 2 disclosed reports; latest 2026-05-05. Updated 2026-11-02._

## How it works

Access control decides on one representation of the request path; the resource handler acts on another. The check sees `%2F`, `%2E`, dot segments, or a path suffix the framework later ignores; the handler sees the decoded, normalized, or truncated path. Any encoding that changes segment count or extension boundary turns a permitted-looking path into a different resource. The same class appears when a glob or regex is compiled without anchoring or without a `/` separator, so `*` crosses segment boundaries the author assumed it could not.

## Where it shows up

- Auth middleware reading `RequestURI()`/raw URL while the handler reads `Path`/decoded path [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rfgq-wgg8-662p.md)
- Glob compiled without a `/` separator, so `*` matches across `/` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rfgq-wgg8-662p.md)
- Regex exemption matched against the full URL including query string [E2](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-everyone-is-finding-vulns-the-hard-part-is-proving-them.md)
- Unanchored blocklist/redirect globs like `/*/membership/*` [E3](https://bugbountylibrary.com/r/h1%3A703058.md)
- Framework quirks: ASP.NET ignoring segments after `.aspx`/`.ashx` [E3](https://bugbountylibrary.com/r/h1%3A703058.md)
- Any layer that decodes, normalizes, or truncates the path after the check

## How to review

The invariant: the exact string the authorization decision is made on must be the same string the handler uses to locate the resource, after all decoding and normalization. Check every layer between the edge and the handler for a second decode or a path rewrite. For globs/regexes, confirm anchoring (`^...$`) and that `*` cannot cross `/` unless intended. Test with `%2F`, `%2E`, `..`, trailing segments after extensions, and query strings appended to exempt paths. Verify auth is enforced at each operation boundary, not just implemented once [E2](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-everyone-is-finding-vulns-the-hard-part-is-proving-them.md).

## How finders spotted it

- Started from a functional complaint that `some%2Fvalue` should match a single-segment wildcard; asking why `%2F` was decoded and how routes matched exposed the encoded-vs-decoded split and separator-less glob [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rfgq-wgg8-662p.md)
- Indexed the codebase, mapped auth boundaries, then reasoned about runtime semantics: what `ctx.request.url` contains in Koa, whether auth matches only the path or the full URL with query [E2](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-everyone-is-finding-vulns-the-hard-part-is-proving-them.md)
- Enumerated the ban-redirect whitelist, noticed `/*/membership/*` was unanchored, and combined it with knowledge of ASP.NET path-after-extension handling [E3](https://bugbountylibrary.com/r/h1%3A703058.md)

## Variants seen

- Encoded URI vs decoded path in auth vs S3 key construction [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rfgq-wgg8-662p.md)
- Regex exemption on full URL including query string [E2](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-everyone-is-finding-vulns-the-hard-part-is-proving-them.md)
- Unanchored glob plus framework path truncation [E3](https://bugbountylibrary.com/r/h1%3A703058.md)

## Impact and severity

E1 allowed unauthenticated PUTs into protected S3 namespaces, and because it applies to any method, also read or deletion of protected objects [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-rfgq-wgg8-662p.md). E3 made account bans broadly ineffective across all `.aspx`/`.ashx` pages and APIs [E3](https://bugbountylibrary.com/r/h1%3A703058.md). E2's Budibase bypass chained with SSRF to reach internal CouchDB and enumerate the Docker network [E2](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-everyone-is-finding-vulns-the-hard-part-is-proving-them.md). Impact rises when the bypass reaches every method or every endpoint, and when chained with SSRF or missing per-operation checks.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-rfgq-wgg8-662p.md
- E2: https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-everyone-is-finding-vulns-the-hard-part-is-proving-them.md
- E3: https://bugbountylibrary.com/r/h1%3A703058.md