Heimdall applies rule matching to the raw request path, while downstream components normalize dot‑segments per RFC 3986. When the path contains dot‑segments or encoded equivalents such as "/user/../admin" or "/user/%2e%2e/admin", Heimdall may grant access to the unnormalized path while the downstream service interprets the request as a different, normalized path (e.g., "/admin"). This mismatch enables an attacker to obtain elevated privileges by accessing resources they should not be able to reach, resulting in an authorization bypass and potential privilege escalation.

All installations of Heimdall version 0.17.13 and earlier are affected. The vulnerability is fixed in Heimdall 0.17.14 and later releases. The vulnerability applies to the default configuration of Heimdall where downstream components perform path normalization according to RFC 3986.

The CVSS score of 7.8 indicates a high severity vulnerability. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Exploitation can be carried out remotely by sending a crafted HTTP request that includes dot‑segments or encoded path components. If the downstream component normalizes the path, the attacker may obtain unauthorized access to protected resources. The attack requires only the ability to send an HTTP request to the Heimdall gateway and a downstream service that normalizes the path.