XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.

Source