GitHub Advisoryadvisory · npm

GHSA-cpfx-964w-4jvp Authentication bypass in @sap/approuter

HIGH Published 2025-02-11 Modified 2025-02-11 Official page ↗
Aliases
CVE-2025-24876
Ecosystem
npm
Packages
@sap/approuter
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-601
Reviewed
2025-02-11

Affected packages

• npm @sap/approuter: >= 2.6.1, < 16.7.2 → fixed in 16.7.2

Description

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session of the victim by injecting malicious payload, causing High impact on confidentiality and integrity of the application.

Related

Alias · CVE (1)

  • CVE-2025-24876 The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References