Home > Vulnerability Database > CVE-2025-57755

Mend.io Vulnerability Database

CVE-2025-57755

Good to know:

Date: August 21, 2025

claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data. The issue has been patched in v1.0.34.

Severity Score

0.0

Related Resources (5)

Url: https://github.com/musistudio/claude-code-router/security/advisories/GHSA-8hmm-4crw-vm2c

Url: https://github.com/musistudio/claude-code-router

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-57755

Url: https://github.com/musistudio/claude-code-router/issues/549

Url: https://www.mend.io/vulnerability-database/CVE-2025-57755

Weakness Type (CWE)

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

Permissive Cross-domain Security Policy with Untrusted Domains

CWE-942

Top Fix

Upgrade Version

Upgrade to version @musistudio/claude-code-router - 1.0.34

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE