Heimdall, a cloud native Identity Aware Proxy, performed HTTP host matching in a case‑sensitive way. Because hostnames are inherently case‑insensitive, requests whose host header differed only in letter case could fail to match the intended rule. This logical error can cause a request to be classified differently than intended, allowing an attacker to obtain or bypass access that should be denied. The weakness is a logical architecture flaw (CWE‑178) compounded by improper validation of input strings (CWE‑436).

The vulnerability affects the Heimdall product provided by dadrus. All releases prior to version 0.17.14 are impacted. Users on any earlier version should consider that a request to, for example, example.com versus EXAMPLE.com may be treated inconsistently and could lead to unauthorized access.

With a CVSS score of 7.8, the issue is considered high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker can manipulate the Host header field in an HTTP request to a Heimdall‑protected resource, choosing a case variation that will not match the stored policy. The attack is straightforward and requires only the ability to send HTTP traffic to the service, making exploitation likely in environments where Heimdall is exposed to untrusted clients.