authentication

Traversing a path into the Home Assistant Supervisor API without a token

An unauthenticated allow-list matched a string while a proxy client normalised a path, three times in a row.

found by Joseph Surin and Victor Kahan, elttam

A second root element: SAML signature bypass in passport-saml

An XML signature covers an element, not a file, and passport-saml picked its element two different ways.

found by Felix Wilhelm, Google Project Zero

Last write wins: an ext_authz authorization bypass in Envoy

Envoy packed request headers for its external authorizer into a protobuf map, so a repeated header arrived with only its last value.