Route confusion is a logic flaw in how an application interprets request paths or selects endpoints. A request may be normalized, matched, or dispatched differently than developers expect, potentially reaching a handler without the intended authentication or permission checks. In APIs, this can happen when routing rules and security checks do not agree about which route a request targets.
Attackers may exploit route confusion to access functionality that should be restricted, or combine it with another weakness-such as SQL injection-to increase impact. The flaw does not automatically mean a system is compromised; the risk depends on the affected routes and their protections. Defenders should apply vendor fixes, test route matching and authorization together, validate request parameters, and ensure every sensitive endpoint enforces explicit permission checks.