A vulnerability was found in the BusyBox httpd reverse proxy feature (networking/httpd.c). The P: reverse-proxy dispatch logic executes before Basic Authentication checks are performed. Because the relay function terminates via cgi_io_loop_and_exit(), which is marked NORETURN, any authentication rule (A:) configured on a proxied URL prefix is effectively dead code. Requests matching a proxy rule are forwarded to the backend server without any credential validation.

Additionally, the byte-transparent nature of the relay allows HTTP request pipelining. An attacker can craft pipelined HTTP requests that reach arbitrary backend paths and methods through the proxy, including administrative endpoints. Any HTTP method, including DELETE, PUT, and POST, is forwarded without credential checks.

This flaw enables unauthenticated remote attackers to access all backend resources behind the proxy, bypass intended access controls, and invoke arbitrary HTTP methods against backend services.