Astro framework version 6.4.7 evaluates authorization on a pathname that has been partially decoded after the decoder reaches its set iteration limit. When the framework later rewrites routes, an additional decodeURI() call is performed, potentially converting the request to a protected path. This disparity allows an attacker to construct a URL that bypasses the initial authorization check and reaches privileged content, representing a serious authorization bypass flaw (CWE-647).

The vulnerability exists in the withastro:astro web framework, specifically affecting Astro version 6.4.7 and earlier releases until the upstream fix was released in 6.4.8.

The CVSS score of 8.2 classifies the issue as high severity, while the EPSS score of <1% indicates a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely exploitation path involves an attacker sending a crafted URL that triggers the decoder iteration limit before authorization, then relying on the later rewrite step to resolve the request to a protected route; this inference is based on the description provided.