In the default configuration, the getter that populates request decorations reads the client-controlled `x-apigateway-event` and `x-apigateway-context` HTTP headers before falling back to the trusted internal request token. Because these reserved headers are not stripped from the incoming event, an unauthenticated attacker can set these headers to forge the entire Lambda proxy event, including the authorizer context. This allows the attacker to override genuine data, leading to a full authentication and authorization bypass and privilege escalation for applications that rely on `request.awsLambda.event` or `request.awsLambda.context` for identity or access control.