cve.bz

CVE-2025-24876

8.1 highEPSS 0.5%

High (8.1). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in @sap/approuter 16.7.2.

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application

Severity

CVSS 3.1

8.1 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWEs
CWE-302, CWE-1287
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-cpfx-964w-4jvpnpm@sap/approuter>=2.6.1 <16.7.216.7.2

References

Check your stackJSON