CVE-2025-24876
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- EPSS probability
- 0.50%
- CWE
- CWE-1287, CWE-302
- Published
- 2025-02-11
- Last modified
- 2026-03-12
Affected products
- SAP_SE SAP Approuter Node.js package
Weakness type
Related vulnerabilities
- CVE-2026-87012 — Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
- CVE-2026-86287 — Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
- CVE-2026-52763 — YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read
- CVE-2026-59680 — yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute
- CVE-2026-82741 — Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
- CVE-2026-80051 — github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar...
- CVE-2026-17113 — Cri-o: cri-o: unvalidated image env var causes daemon crash
- CVE-2026-5304 — An ACAP configuration file lacks input validation, which could potentially lead to privilege...