A security researcher found that adding a trailing slash to AWS HTTP API paths bypassed Lambda authorizer authentication entirely, enabling unauthenticated wire transfers at a fintech. The root cause is a path normalization mismatch between HTTP API's greedy …
Security researcher Piyush Gupta discovered that adding a trailing slash to API paths on AWS HTTP API, the newer and cheaper variant of API Gateway, could bypass Lambda authorizer authentication enti…