Incorrect Comparison

Summary

Alpine is a scaffolding library in Java. In us.springett:alpine-server package versions prior to 3.0.0 allow Authentication Filter Bypass vulnerability. The "AuthenticationFilter" relies on the request URI to evaluate if the user is accessing the swagger endpoint. By accessing a URL with a path such as "/api/foo;%2fapi%2fswagger" the contained condition will hold and will return from the authentication filter without aborting the request. Note that the principal object will not be assigned and therefore the issue won't allow user impersonation.