Admin Panel Exposure via WAF Bypass (URL Encoding) + Broken reCAPTCHA + Internal Info Leak

Summary

The WAF rule protecting the admin panel at /admin/* can be bypassed by URL-encoding any single character in the path. Where a direct request to the admin login is redirected away, an encoded variant (e.g. %61dmin → admin) passes straight through and renders the full admin login form.

The exposed login then has effectively no bot protection: its reCAPTCHA v3 is wired up with an empty sitekey, so it never initializes or validates. Combined with no observed rate-limiting, this leaves the admin auth endpoint open to unlimited automated login attempts.

Separately, a production JavaScript bundle leaks an internal employee email address (a plausible valid admin username) along with an Azure AD tenant ID, both embedded in a Microsoft SafeLinks URL that had been pasted in place of the analytics host.

• Class: WAF bypass (input normalization gap) + security misconfiguration (broken CAPTCHA) + sensitive information disclosure
• Affected asset: [REDACTED-HOST] — Symfony-based admin panel (primary)