The application does not properly handle duplicate HTTP parameters, allowing attackers to inject additional parameters that override or supplement existing ones to bypass validation.
An attacker could bypass input validation, WAF rules, or access controls by supplying duplicate parameters that are processed differently by front-end and back-end components.
Standardize parameter handling across all application layers. Reject requests with duplicate parameters. Use a consistent parameter parsing strategy. Validate parameters after all processing stages.