Cross-origin validation bypass via redirect-matched patterns

Improper access control in Go standard library net/http 1.25.0 allows remote attackers to bypass cross-origin request validation. The AddInsecureBypassPattern check asks an internal ServeMux whether a path matches; redirect normalization can match a trailing-slash pattern, but the wrapper forwards the unchanged path to a different handler. Exploitation requires an application to configure a bypass pattern and a user to initiate a crafted cross-origin request, allowing that request to reach a handler without the intended CSRF protection.