# Route rewrite dot-segment auth bypass

Proxy rewrite middleware forwards un-normalized paths with injected dot-segments after routing, skipping auth middleware

_Area: Web access control and IDOR. Seen in 2 disclosed reports; latest 2026-08-06. Updated 2026-10-24._

## How it works
A proxy or rewrite middleware substitutes a user-controlled capture into the request path and forwards the result without re-normalizing it. Routing already happened against the original path, so the rewritten path (now containing `..` dot-segments) reaches a backend route whose auth middleware was never applied. The broken assumption: that a rewritten path is equivalent to its normalized form. When a capture group can inject `..`, it is not.

## Where it shows up
- Regex rewrites with a capture that lacks a mandatory separator, e.g. `^/api(.*)` instead of `^/api/(.*)` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-cxjq-mrr5-89rv.md).
- Middleware that does string replacement on the path and forwards without a normalization/equality check [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-cxjq-mrr5-89rv.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-8rxv-jg7p-wvg3.md).
- Sibling middlewares duplicating the same rewrite logic (StripPrefix, StripPrefixRegex, ingress-nginx RewriteTarget) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-8rxv-jg7p-wvg3.md).
- Parameters concatenated into an XHR/URL with a forced suffix, where traversal escapes the intended directory [E2](https://bugbountylibrary.com/r/h1%3A99708.md).
- Same-origin GET endpoints (OAuth callbacks) that skip CSRF enforcement [E2](https://bugbountylibrary.com/r/h1%3A99708.md).

## How to review
For every path-rewriting middleware, check the invariant: the forwarded path must equal its normalized form (e.g. JoinPath equality after PathUnescape). Confirm the check exists and runs after substitution, not only in one sibling. Verify regexes require a separator before the capture. For URL-building code, confirm parameters are validated as integers or escaped, not concatenated. For callbacks, confirm CSRF tokens are enforced on GET.

## Variants seen
- ReplacePathRegex capture injecting `..` after substitution [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-cxjq-mrr5-89rv.md).
- ingress-nginx RewriteTarget applying the same rewrite without the normalization invariant [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-8rxv-jg7p-wvg3.md).
- Path traversal in a report_id parameter reaching an OAuth callback to bypass CSRF [E2](https://bugbountylibrary.com/r/h1%3A99708.md).

## Why fixes fail
A normalization check was added to StripPrefix (CVE-2026-48020) but not applied to ReplacePathRegex [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-cxjq-mrr5-89rv.md) or RewriteTarget [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-8rxv-jg7p-wvg3.md); patching one middleware left siblings exploitable.

## Impact and severity
Unauthenticated access to auth-protected backend routes and forged integration requests. Severity rises when the bypass reaches admin or cross-tenant routes and when multiple sibling middlewares share the flaw.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-cxjq-mrr5-89rv.md
- E2: https://bugbountylibrary.com/r/h1%3A99708.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-8rxv-jg7p-wvg3.md