CWE-551
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Impactr finds and proves whether CWE-551 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.