Credential theft via noncanonical gateway routes

Path validation failure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows attackers to steal credentials via deceptive gateway routes. The route creation component accepts a gateway_path beginning with // without normalizing or rejecting it, enabling a look-alike route to capture and exfiltrate user credentials in cleartext. Administrative route-creation access, or social engineering of an administrator, is required; captured credentials can sustain access after the route creator's privileges are revoked.