CVE-2025-9909

The record

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.

Affected packages

Related vulnerabilities

• CVE-2026-80515 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that… CWE-647
• CVE-2026-15970 Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an… CWE-647
• CVE-2026-8384 In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an… CWE-647
• CVE-2026-59731 Astro is a web framework for content-driven websites. CWE-647
• CVE-2026-5222 Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries… CWE-647
• CVE-2025-66202 Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CWE-647
• GHSA-whqg-ppgf-wp8c Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CWE-647
• CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass CWE-647