Improper handling of case sensitivity in the Erlang/OTP inets httpd component allows an attacker to bypass directory protection set by mod_auth. A request that differs only in letter casing from the configured protected path does not trigger the authentication check because the matching routine is performed without case‑insensitivity. On a case‑insensitive filesystem, the operating system resolves the mismatched path to the same file, and the web server serves it. The result is that any file located within a protected directory can be read without authentication.

Erlang/OTP versions before 27.3.4.17, before 28.5.0.6, and before 29.0.6 are affected. The corresponding inets revisions are 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. Deployments running OTP 17.0 or later, up to but excluding those thresholds, are potentially impacted if they operate on a case‑insensitive filesystem. The vulnerability is not present on case‑sensitive filesystems.

With a CVSS score of 8.2 the vulnerability is classified as high severity. Since the EPSS score is not available, the current exploitation probability cannot be quantified, but the lack of any known exploit and absence from the CISA KEV catalog suggest a lower but non‑negligible risk. Attackers need only be able to issue HTTP requests to the host; authentication is not required. The vulnerability is exploitable remotely via standard web traffic and can be triggered on any misconfigured Erlang/OTP web application that places protected directories on a case‑insensitive filesystem.