CVE-2026-00000 (illustrative): authentication bypass in a sample gateway

Overview

CVE-2026-00000 (illustrative) describes an authentication bypass in a fictional API gateway, “SampleGate”, in which an alternate request encoding is authorized by the edge but resolves to a protected handler in the upstream service.

Severity

The scope change (S:C) reflects that a flaw in the gateway grants access to a separate upstream component, and the impact spans confidentiality and integrity of protected resources.

Affected versions

Product	Affected	Fixed in
SampleGate	2.0.0 – 2.4.1	2.4.2
SampleGate	3.0.0 – 3.1.0	3.1.1

Root cause

The gateway authorizes requests against a normalized path, then forwards the original, un-normalized path upstream. Because the two components disagree about how to decode a path segment, a request the gateway treats as public resolves upstream to an authenticated endpoint, a classic confused-deputy condition.

Detection

Compare the path the gateway authorized against the path delivered upstream. A mismatch, especially one involving encoded separators or dot-segments, on a request that reached a protected handler is the signature to alert on.

Remediation