# Path traversal auth bypass

Auth checks one path string; the resource is resolved from a different, normalized path

_Area: Web access control and IDOR. Seen in 9 disclosed reports; 4 confirmed bounties, median $7,000, range $2,500-$11,000; latest 2026-10-15. Updated 2026-10-23._

## How it works
Access control decides on one path string, but the resource is resolved from another. A proxy, framework, router, or ingress normalizes `../`, `..;/`, `%2e%2e%2f`, backslashes, `.`, or doubled slashes at a different layer or time than the auth check. The string that was authorized is not the resource that gets served. The broken assumption: "the path we checked is the path we use." The unifying property is a normalization mismatch between the decision point and the resolution point; classic `../` traversal is one shape, double-slash routing another [E6](https://bugbountylibrary.com/r/h1%3A1829170.md).

## Where it shows up
- Auth by URL prefix (`/servicedesk/`, `/api/`) instead of resolved resource [E5](https://bugbountylibrary.com/r/blog%3Asamcurry-net-analysis-of-cve-2019-14994.md)
- Proxy normalizes but backend does not, or vice versa [E1](https://bugbountylibrary.com/r/h1%3A1040786.md)
- Front end authorizes on URL, back end routes on a header like `X-DSCGI-PATH` [E1](https://bugbountylibrary.com/r/h1%3A1040786.md)
- Proxy/BFF handlers passing user path segments to internal hosts [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-starbucks.md)
- Ingress forwarding raw `$request_uri` to an external auth service doing prefix match [E7](https://bugbountylibrary.com/r/blog%3Axvnpw-github-io-posts-external-authentication-bypass-in-ingress-nginx.md)
- Authz reads one path segment, handler acts on another after `../` [E8](https://bugbountylibrary.com/r/blog%3Ablog-usamav-dev-two-account-takeover-bugs-worth-4300-dollar-bounty.md)
- Path variants (`//`, `/./`, encoded slashes) reaching the same handler while evading path-based middleware [E6](https://bugbountylibrary.com/r/h1%3A1829170.md)
- Security middleware and router keying on different request representations (decoded `Path` vs `RawPath`) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-23vg-4cjm-66q5.md)
- Middleware matching the raw request target while the router resolves absolute-form targets [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-9c5c-9qcx-q35q.md)

## How to review
Find the exact string the authorization decision uses and the exact string the resource lookup uses; they must be identical after canonicalization. Name the canonicalization function each layer calls (e.g. `File.expand_path`, `path.Clean`, `URI.normalize`, Tomcat's `normalize()`) and confirm both the decision point and the resolution point use the same canonical form, so the backend re-resolves the same canonical path. For prefix checks, require a separator boundary or realpath containment, not string prefix. For proxy/backend mismatches, compare what each layer logs for the same request: if the proxy log shows `/api/v1/x` and the backend log shows `/admin/x` for one request, the auth layer and the routing layer disagree [E1](https://bugbountylibrary.com/r/h1%3A1040786.md). For header-vs-URL routing, confirm the auth layer and the router read the same source (URL or header), not one each [E1](https://bugbountylibrary.com/r/h1%3A1040786.md). For ingress-to-external-auth, confirm the auth service receives a normalized path, not raw `$request_uri` [E7](https://bugbountylibrary.com/r/blog%3Axvnpw-github-io-posts-external-authentication-bypass-in-ingress-nginx.md). For middleware, confirm it keys on the same representation the router dispatches on [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-23vg-4cjm-66q5.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-9c5c-9qcx-q35q.md).

## Variants seen
- Proxy normalizes, backend does not; endpoint echoes signed upload JWT [E1](https://bugbountylibrary.com/r/h1%3A1040786.md)
- URL authorized, header routed [E1](https://bugbountylibrary.com/r/h1%3A1040786.md)
- Backslash traversal through BFF proxy to internal API; backslash also evades WAFs that only block `../` [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-starbucks.md)
- Raw `$request_uri` forwarded to external auth doing prefix match [E7](https://bugbountylibrary.com/r/blog%3Axvnpw-github-io-posts-external-authentication-bypass-in-ingress-nginx.md)
- Authz on first segment, action on traversed segment [E8](https://bugbountylibrary.com/r/blog%3Ablog-usamav-dev-two-account-takeover-bugs-worth-4300-dollar-bounty.md)
- Double-slash path routed to same handler without re-applying restriction [E6](https://bugbountylibrary.com/r/h1%3A1829170.md)
- Decoded `Path` vs `RawPath` operation confusion [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-23vg-4cjm-66q5.md)
- Absolute-form request target bypassing path-scoped middleware [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-9c5c-9qcx-q35q.md)

## Impact and severity
High: internal-API/Graph exposure [E2](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-starbucks.md), auth bypass [E7](https://bugbountylibrary.com/r/blog%3Axvnpw-github-io-posts-external-authentication-bypass-in-ingress-nginx.md), account takeover [E8](https://bugbountylibrary.com/r/blog%3Ablog-usamav-dev-two-account-takeover-bugs-worth-4300-dollar-bounty.md), mass issue disclosure [E5](https://bugbountylibrary.com/r/blog%3Asamcurry-net-analysis-of-cve-2019-14994.md). Worse when tokens are echoed [E1](https://bugbountylibrary.com/r/h1%3A1040786.md), identifiers are brute-forceable, or filters are string-based. E1 is a multi-bug chain: the traversal component leaks the Workhorse JWT, but the git-push impact also depends on Geo header spoofing, so do not attribute the full impact to traversal alone.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1040786.md
- E2: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-starbucks.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-23vg-4cjm-66q5.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-9c5c-9qcx-q35q.md
- E5: https://bugbountylibrary.com/r/blog%3Asamcurry-net-analysis-of-cve-2019-14994.md
- E6: https://bugbountylibrary.com/r/h1%3A1829170.md
- E7: https://bugbountylibrary.com/r/blog%3Axvnpw-github-io-posts-external-authentication-bypass-in-ingress-nginx.md
- E8: https://bugbountylibrary.com/r/blog%3Ablog-usamav-dev-two-account-takeover-bugs-worth-4300-dollar-bounty.md