I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty | Hacker News

A security researcher found an AWS API Gateway auth bypass caused by a trailing-slash URL mismatch.

By using a crafted domain and subdomain setup, the researcher was able to reach blocked endpoints.

The issue shows how small URL normalization differences can lead to real authentication failures.

AWS treated the report as a valid vulnerability and awarded a $12,000 bug bounty.