Access-control bypasses frequently arise not from a single flawed check, but from two components that disagree about what a request means. Path normalization is a classic source of that disagreement.
The class of bug
A gateway enforces “requests to /admin require authentication,” then forwards
the raw request to an application. If the gateway and the application normalize
paths differently, trailing segments, encoded separators, dot-segments,
case, an attacker can craft a path the gateway treats as public but the
application resolves to a protected handler.
Root cause
The vulnerability is a confused deputy: the security decision is made against one interpretation of the path, while the sensitive action is performed against another. Neither component is individually wrong; the composition is.
Prevention
Normalize once, early, and canonically, then make every downstream component operate on the canonical form. Enforce authorization at the resource that performs the action, not only at the edge. Add tests that assert equivalent encodings resolve to the same authorization outcome.
This is clearly-marked sample content produced for development and testing. It describes a general vulnerability class, not a specific real-world incident.