# CVE-2025-66202

## Summary

- **CVE ID:** CVE-2025-66202
- **Severity:** MEDIUM
- **CVSS Score:** 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **CWE:** CWE-647
- **Published:** Dec 8, 2025
- **Last Modified:** Mar 13, 2026

## Description

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.

## Affected Products

- withastro — astro (< 5.15.8)

## References

- [CNA](https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c)
- [CNA](https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794)
- [CNA](https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.31%
- **EPSS Percentile:** 24.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._