Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-24876

Good to know:

icon

Date: February 10, 2025

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application

Severity Score

Related Resources (6)

https://me.sap.com/notes/3567974
https://www.npmjs.com/package/@sap/approuter?activeTab=versions
https://nvd.nist.gov/vuln/detail/CVE-2025-24876
https://url.sap/sapsecuritypatchday
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2025.html
https://www.mend.io/vulnerability-database/CVE-2025-24876

Severity Score

Weakness Type (CWE)

URL Redirection to Untrusted Site ('Open Redirect')

CWE-601

Authentication Bypass by Assumed-Immutable Data

CWE-302

Improper Validation of Specified Type of Input

CWE-1287

Top Fix

icon

Upgrade Version

Upgrade to version @sap/approuter - 16.7.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us