Astro strips a configured non‑root base path from request pathnames using a simple string‑prefix test that fails to verify a path‑segment boundary. This is a CWE‑187 (Partial Comparison) flaw. With a base of "/app", a request to "/appX/admin" is internally resolved to the protected "/admin" route while the middleware still observes the original pathname. This flaw lets an unauthenticated attacker publicly request a crafted URL and bypass pathname‑based middleware, gaining access to routes that should be protected.

The vulnerability affects all installations of the Astro web framework produced by withastro:astro that are running a version earlier than 7.2.4 and use a configured base path. Deployments of Astro on any content‑driven site that rely on path‑based authorization middleware are susceptible.

The CVSS score of 6.3 indicates moderate severity, and the flaw can be exploited remotely via normal HTTP requests without requiring privileged state. The EPSS score is not available, so the current exploitation likelihood is unknown, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to supply a malicious URL containing the missing slash to trigger the bypass, making this a readily actionable attack vector for public‑facing applications.