Ory Oathkeeper has a path traversal authorization bypass
No sign of exploitation. No public exploitation artifact known so far.
Ory Oathkeeper versions before 26.2.0 allow attackers to bypass access controls by using path traversal tricks (like `/public/../admin`) in URLs. The system checks the disguised path against permission rules but then processes the real path, letting attackers reach protected areas they shouldn't access.
An authorization bypass vulnerability exists in Ory Oathkeeper's rule evaluation engine, which matches HTTP requests against Access Rules using raw, un-normalized paths. An attacker can craft URLs with path traversal sequences that resolve to protected endpoints after normalization, bypassing access controls because rule matching occurs before path normalization. The vulnerability affects versions prior to 26.2.0.