oxyno-zeta/s3-proxy versions before 5.0.0 contain an authentication bypass vulnerability caused by inconsistent handling of URL paths between the authentication middleware and the bucket handler. The middleware checks resource paths against the percent-encoded request URI, while the bucket handler uses the decoded path, leading to a mismatch. This discrepancy, combined with the glob library's behavior allowing '*' to match across path separators, enables unauthenticated attackers to perform path traversal attacks. Exploitation techniques include using '*' patterns that cross directory boundaries, percent-encoded slashes (%2F) to collapse path segments, and dot-dot (../) segments under '**' prefix patterns. These allow attackers to access or modify objects in protected S3 namespaces without authentication. The vulnerability is fixed in s3-proxy version 5.0.0.

An unauthenticated attacker with network access can bypass authentication controls and perform unauthorized PUT, GET, or DELETE operations on objects within authentication-protected S3 namespaces. This compromises confidentiality and integrity of stored objects and can cause partial availability impact. The CVSS 3.1 score of 9.4 reflects critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

A fixed version (5.0.0) of s3-proxy is available that resolves this authentication bypass and path traversal vulnerability. Users should upgrade to version 5.0.0 or later. Since s3-proxy is a cloud service, the vendor manages remediation for hosted instances; users should verify with the vendor that their service is updated. Patch status is confirmed as fixed in version 5.0.0. No additional mitigations are indicated by the vendor advisory.