# Redirect whitelist path bypass

Unanchored glob or path-after-extension parsing letting blocked or foreign paths satisfy a whitelist check

_Area: Web access control and IDOR. Seen in 2 disclosed reports; latest 2026-06-16. Updated 2026-11-07._

## How it works
A security decision (ban redirect, mTLS requirement, sandbox restriction) is made by matching a request path or host against a whitelist/rule set. The check and the component that actually routes the request parse the same string differently. Two divergences recur: the pattern is unanchored, so a mid-path wildcard can be satisfied by appending a segment to any URL [E2](https://bugbountylibrary.com/r/h1%3A703058.md); or the framework ignores trailing path segments after an extension, so `/page.aspx/membership/` reaches `/page.aspx` while still matching `/*/membership/*` [E2](https://bugbountylibrary.com/r/h1%3A703058.md). The same class appears when a security check re-implements host matching separately from the router: wildcard rules are honored by the router but not by the check, so a stricter policy is silently not applied [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md). The broken assumption is that "the string the check sees" equals "the resource the backend serves."

## Where it shows up
- Glob/redirect rules with a leading or mid-path `*` and no `^`/`$` anchoring, e.g. `/*/membership/*` [E2](https://bugbountylibrary.com/r/h1%3A703058.md)
- ASP.NET `.aspx`/`.ashx` endpoints where path info after the extension is ignored by the handler [E2](https://bugbountylibrary.com/r/h1%3A703058.md)
- Security middleware that does its own host/SNI lookup with exact map keys while the router does wildcard matching [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md)
- Per-entrypoint policies where a permissive rule coexists with a stricter wildcard rule [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md)
- Sandbox/policy checks that special-case `file://` or `\\localhost\` but not alternate UNC/device spellings [E3](https://bugbountylibrary.com/r/h1%3A150976.md)

## How to review
Identify every place a path or host is matched for a security decision, then ask: does the matcher anchor both ends, and does the backend resolve the same string to the same resource? The invariant: for any request the backend will serve, the security check must classify it identically to the router. Test by appending path segments after extensions, inserting the whitelisted segment mid-path, and comparing wildcard vs exact host resolution between the check and the router [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md)[E2](https://bugbountylibrary.com/r/h1%3A703058.md). For sandbox checks, enumerate alternate spellings of the same path and confirm the policy normalizes before deciding [E3](https://bugbountylibrary.com/r/h1%3A150976.md).

## How finders spotted it
- Enumerated the ban-redirect whitelist rules, noticed `/*/membership/*` was unanchored, and combined it with knowledge that ASP.NET ignores segments after `.aspx`/`.ashx` [E2](https://bugbountylibrary.com/r/h1%3A703058.md)
- Read a public issue where wildcard hosts were classified as `default` by SNICheck (421 errors), and hypothesized the same wildcard gap was a security false-negative when a permissive SNI shared the entrypoint [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md)
- Prior research on `navigateToURL` and `jar:` abuse led to testing alternate path forms (UNC-style `\\.\localhost`) against the local-with-filesystem restriction [E3](https://bugbountylibrary.com/r/h1%3A150976.md)

## Variants seen
- Unanchored glob whitelist plus framework path-after-extension handling [E2](https://bugbountylibrary.com/r/h1%3A703058.md)
- Security check using exact host lookup while router uses wildcard matching [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md)
- Sandbox policy not normalizing UNC/device path spellings [E3](https://bugbountylibrary.com/r/h1%3A150976.md)

## Impact and severity
E2 defeated account bans across all `.aspx`/`.ashx` pages and APIs, and `api.roblox.com` had no ban check at all, so reach scaled with endpoint coverage [E2](https://bugbountylibrary.com/r/h1%3A703058.md). E1 was an mTLS bypass on wildcard routers via domain fronting, high severity because it removed a client-auth requirement [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md). E3 allowed a malicious SWF to read local files in IE [E3](https://bugbountylibrary.com/r/h1%3A150976.md). Impact rises when the bypassed control is the only gate on a whole API surface [E2](https://bugbountylibrary.com/r/h1%3A703058.md) or when a permissive rule shares scope with a strict one [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **github.com/traefik/traefik/v2 (go)** < 2.11.48, fixed in 2.11.48: Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass (CVE-2026-48491). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-5r4w-85f3-pw66.md
- E2: https://bugbountylibrary.com/r/h1%3A703058.md
- E3: https://bugbountylibrary.com/r/h1%3A150976.md