CWE-647
Use of Non-Canonical URL Paths for Authorization Decisions
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
Impactr finds and proves whether CWE-647 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.