CVE-2025-57755CWE-200CWE-942

claude-code-router CORS. misconfiguration

High · published August 21, 2025

CVSS v4.0
8.1
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data. The issue has been patched in v1.0.34.

The record
Technical detail
CVSS v4.0
8.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00305 · 22.1th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2025-08-21T16:21Z
EPSS history
Timeline
  • 21 AUG 16:21Z
    claude-code-router CORS. misconfiguration
    cvelistv5