CVE-2025-24876CWE-1287CWE-302

Authentication bypass via authorization code injection in SAP Approuter

High · published February 11, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.6th percentile
Weaknesses
CWE-1287 · Improper Validation of Specified Type of Input; CWE-302 · Authentication Bypass by Assumed-Immutable Data
Published
2025-02-11T00:37Z
EPSS history
Timeline
  • 11 FEB 00:37Z
    Authentication bypass via authorization code injection in SAP Approuter
    cvelistv5