Gateway lets an administrator create routes. There is some validation, but they allow routes starting a double slash (//), that look very much like legitimate URLs. This can be used to set up a "honey-pot" route to capture and exfiltrate user credentials.

This is a problem because a malicious admin could use this to create a backdoor to retain access after their permissions are revoked. It could also be exploited by an external attacker who social engineers a legitimate admin, convincing them to add the route for "troubleshooting" or "diagnostics" without the admin knowing what it's really for.

A core issue is that the gateway_path field doesn't properly sanitize its input, allowing these look-alike paths to be created.