Middleware Auth Bypass

Authentication/authorization checks fail to run because middleware is misconfigured or conditionally skipped—via excluded route matchers, missing auth dependencies, or incorrect middleware return semantics—so unauthorized requests reach handlers or redirects land outside enforcement.