CVE-2025-24876
published 2025-02-11CVE-2025-24876: The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal…
PriorityP346high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.49%
39.9th percentile
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | approuter | >= 2.6.1 < 16.7.2 | 16.7.2 |
| sap_se | sap_approuter_node.js_package | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Authentication bypass in @sap/approuter
osv·2025-02-11
CVE-2025-24876 [HIGH] Authentication bypass in @sap/approuter
Authentication bypass in @sap/approuter
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session of the victim by injecting malicious payload, causing High impact on confidentiality and integrity of the application.
GHSA
Authentication bypass in @sap/approuter
ghsa·2025-02-11
CVE-2025-24876 [HIGH] CWE-601 Authentication bypass in @sap/approuter
Authentication bypass in @sap/approuter
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session of the victim by injecting malicious payload, causing High impact on confidentiality and integrity of the application.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-02-11
Published