CVE-2025-24876

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-302 CWE-1287

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-24886.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Profelis Informatics SambaBox a CVE-2025-248825.2regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without dete CVE-2025-248838.7go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash us CVE-2025-248845.1kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration wa CVE-2025-248857.6pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control CVE-2025-248867.7pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink chec CVE-2025-248876.3OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be CVE-2025-248888.1The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Works CVE-2025-248894.5The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Works CVE-2025-24896.8Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know t CVE-2025-248906.8gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controll CVE-2025-248919.6Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to