Heimdall, a cloud native Identity Aware Proxy, processes URL-encoded slashes in a case‑sensitive manner. While percent‑encoding is defined to be case‑insensitive, the software only recognizes the uppercase %2F. When allow_encoded_slashes is set to off—its default setting—the lowercase %2f is treated as a literal slash by Heimdall but is ignored by upstream components, leading to inconsistent path interpretation. This discrepancy can allow an attacker to craft requests that resolve to protected paths in Heimdall but not in upstream services, effectively bypassing intended authorization checks and enabling unauthorized access to resources.

The flaw impacts the Heimdall service released by Dadrus. Any deployment of Heimdall before version 0.17.14 is vulnerable; the fix was introduced in that release. Systems running the default configuration, with allow_encoded_slashes disabled, are at risk.

The CVSS score of 7.8 classifies the vulnerability as high severity. Exploitation would be performed over the network by sending crafted HTTP requests that contain lowercase %2f to trigger inconsistent path handling between Heimdall and upstream services. Because Heimdall is commonly exposed to the Internet, the likelihood of exploitation is significant, although no publicly disclosed exploits are currently listed in KEV or reported. Attackers would not need elevated privileges, making this vector readily exploitable if no additional controls are in place.