A vulnerability in nono-py versions prior to 0.11.0 allows an authorization bypass due to a policy confusion issue. The Python API's restrictive configuration for reverse-proxy credential routes is unsafe by default, permitting broader network access than intended. Specifically, an empty allowed_hosts setting results in an implicit allow-all policy inside nono-proxy, enabling a sandboxed child process to use the local proxy as a transparent CONNECT tunnel to unintended hosts. This bypasses the intended route-only proxy access policy, potentially exposing internal or internet services to unauthorized access or data exfiltration. The severity is medium by default but can be high in environments relying on strict egress controls. No known exploits are reported, and no patch information is provided.