There is some subtle timing problem that results in Lucee getting confused about which index.cfm file to render. For example, I request /sso/index.cfm, but Lucee renders /index.cfm. Using the FusionReactor debugger, I can confirm that CGI.script_name is /sso/index.cfm, so it's not a rewrite problem. It's also perhaps worth mentioning that /sso/Application.cfc extends the root Application.cfc.
On our production servers, we have seen the exact same code behave differently in this regard. For example, one server was rendering the wrong index.cfm at /sso/index.cfm, another was doing so at /socket/cxml/index.cfm, and a third had no problem with either subdirectory.
I was able to reproduce this once locally (in my Docker-based dev env) on 184.108.40.206, but it's very difficult to repro due to the timing issues. I also have not been able to repro the problem outside of my application.
Downgrading our production servers to 220.127.116.11 cleared up the problem, and I haven't been able to repro locally on 18.104.22.168.
I suspect that this change may be the culprit, because it modifies class loading behavior. https://github.com/lucee/Lucee/commit/32c292627981f0bc97fc59db737a282f36116afe . That change has no associated tests or tickets, so I'm not sure what problem it was meant to fix.
We will continue to run on 22.214.171.124 for a few days and I will update this ticket later in the week to confirm whether the downgrade seems to have fixed the problem.
Docker, and also CentOS 7.7